3.9low
CVE-2017-9635
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
3.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 14%
Public exploits
0
none known
Summary
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
Exploit prediction (EPSS)
0.23% probability of exploitation in the next 30 days, higher than 14% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 3.9 | CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L |
| NVD | 2.0 | 1.9 | AV:L/AC:M/Au:N/C:P/I:N/A:N |
Affected products
- Schneider Electric SE Ampla MES
Classification
- Weakness
- CWE-326 Inadequate Encryption Strength
References
- ics-cert.us-cert.gov /advisories/ICSA-17-187-05 · x_refsource_MISC, x_transferred
- software.schneider-electric.com /pdf/security-bulletin/lfsec00000118/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/99469 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-9635
- NVD: CVE-2017-9635
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.