CVE-2014-5413 Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues

What is CVE-2014-5413?

CVE-2014-5413 is a medium-severity vulnerability in Schneider Electric ClearSCADA, published on 18 Sep 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm.

Weakness: CWE-310

Which versions are affected by CVE-2014-5413?

It affects 2 products.

Products include Aveva Clearscada, Schneider-Electric Scada Expert Clearscada.

How do I fix CVE-2014-5413?

No fix has been published for CVE-2014-5413 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-5413 being exploited?

There is no known exploitation of CVE-2014-5413 in the wild and no public exploit code.

Other vulnerabilities in Schneider Electric ClearSCADA

• CVE-2011-3143 Use after free in n/a Critical 10.0
• CVE-2017-6021 Denial of service in ClearSCADA High 7.5
• CVE-2017-9962 Memory corruption in ClearSCADA High 7.5
• CVE-2014-0779 Memory corruption in ClearSCADA Medium 6.8
• CVE-2014-5412 Schneider Electric SCADA Expert ClearSCADA Improper Authentication Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wxww-p46r-jjv2.