Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases.

Published 8 y ago 2018-05-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.2%

percentile 14%

Public exploits

none known

Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.

Exploit prediction (EPSS)

0.23% probability of exploitation in the next 30 days, higher than 14% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	4.1	`CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	1.9	`AV:L/AC:M/Au:N/C:P/I:N/A:N`

Affected products

Schneider Electric SE Ampla MES

Classification

Weakness

CWE-319 Cleartext Transmission of Sensitive Information
CWE-522 Insufficiently Protected Credentials

References

ics-cert.us-cert.gov /advisories/ICSA-17-187-05 · x_refsource_MISC, x_transferred
software.schneider-electric.com /pdf/security-bulletin/lfsec00000118/ · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/99469 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2017-9637
NVD: CVE-2017-9637

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.