{ "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "ClearSCADA", "vendor": "Schneider Electric", "versions": [ { "status": "affected", "version": "2010 R3 (build 72.4560)" }, { "status": "affected", "version": "2010 R3.1 (build 72.4644)" }, { "status": "unaffected", "version": "2010 R3.2" } ] }, { "defaultStatus": "unaffected", "product": "SCADA Expert ClearSCADA", "vendor": "Schneider Electric", "versions": [ { "status": "affected", "version": "2013 R1 (build 73.4729)" }, { "status": "affected", "version": "2013 R1.1 (build 73.4832)" }, { "status": "affected", "version": "2013 R1.1a (build 73.4903)" }, { "status": "affected", "version": "2013 R1.2 (build 73.4955)" }, { "status": "affected", "version": "2013 R2 (build 74.5094)" }, { "status": "affected", "version": "2013 R2.1 (build 74.5192)" }, { "status": "affected", "version": "2014 R1 (build 75.5210)" }, { "status": "unaffected", "version": "2014 R1.1" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Aditya Sood" } ], "datePublic": "2014-09-16T06:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm." } ], "value": "Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm." } ], "metrics": [ { "cvssV2_0": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-310", "description": "CWE-310", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-11-04T22:59:00.297Z" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-259-01a" }, { "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-259-01a.json" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Asset owners should always obtain a signed web certificate from a \ncertified authority before deploying ClearSCADA Web Server in a \nproduction environment.

\n

To assist asset owners who are currently using self-signed \ncertificates, a standalone utility will be made available that can be \nused to generate and deploy a new self-signed certificate (signed using \nan SHA signing algorithm). This utility is recommended for existing \nClearSCADA systems subject to this vulnerability, removing the need to \nupgrade the ClearSCADA software and perform a manual generation of a new\n certificate. This utility will be made available within the Software \nDownloads section of the following ClearSCADA Resource Center page:

\n

http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support

" } ], "value": "Asset owners should always obtain a signed web certificate from a \ncertified authority before deploying ClearSCADA Web Server in a \nproduction environment.\n\n\nTo assist asset owners who are currently using self-signed \ncertificates, a standalone utility will be made available that can be \nused to generate and deploy a new self-signed certificate (signed using \nan SHA signing algorithm). This utility is recommended for existing \nClearSCADA systems subject to this vulnerability, removing the need to \nupgrade the ClearSCADA software and perform a manual generation of a new\n certificate. This utility will be made available within the Software \nDownloads section of the following ClearSCADA Resource Center page:\n\n\n http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support" } ], "source": { "advisory": "ICSA-14-259-01", "discovery": "EXTERNAL" }, "title": "Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues", "x_generator": { "engine": "Vulnogram 0.5.0" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2014-5411", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01" } ] } } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T11:41:49.210Z" }, "title": "CVE Program Container", "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01" } ] } ] }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2014-5413", "datePublished": "2014-09-18T10:00:00.000Z", "dateReserved": "2014-08-22T00:00:00.000Z", "dateUpdated": "2025-11-04T22:59:00.297Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.2" }