CVE-2017-9637
N/A
N/A
Summary
Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Schneider Electric SE | Ampla MES | versions 6.4 and prior | affected |
Weaknesses
- CWE-319: Cleartext transmission of sensitive information CWE-319
ADP Enrichment
CVE Program Container
Additional References
- https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
- http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
- http://www.securityfocus.com/bid/99469
References
- https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
- http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
- http://www.securityfocus.com/bid/99469
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.