Two vulnerabilities in Schneider Electric Ampla MES
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2017-9637 CVE-2017-9635 |
| CWE-ID | CWE-319 CWE-326 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Ampla MES Client/Desktop applications / Other client software |
| Vendor | Schneider Electric |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Cleartext transmission of sensitive information
EUVDB-ID: #VU7374
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9637
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to obtain credentials on the target system.
The weakness exists due to cleartext transmission of sensitive information. When connectivity to third party databases is configured to use a SQL user name and password, a local attacker sniff details from the connection string.
Successful exploitation may result in compromise of credentials used to connect to third party databases.
MitigationUpdate to version 6.5.
Ampla MES: 6.0 - 6.4
External linkshttp://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Inadequate encryption strength
EUVDB-ID: #VU7375
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9635
CWE-ID:
CWE-326 - Inadequate Encryption Strength
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to obtain credentials on the target system.
The weakness exists due to weakness in the password hashing algorithm. When Ampla MES users are configured to use Simple Security, a local attacker can reverse the user’s password.
Successful exploitation may result in compromise credentials of Ampla users configured with Simple Security.
MitigationUpdate to version 6.5.
Ampla MES: 6.0 - 6.4
External linkshttp://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
