CVE-2017-9635 Weak cryptography in Ampla MES
Weak password hashing in Ampla MES allows attackers to reverse user passwords when Simple Security is enabled, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9635?
CVE-2017-9635 is a low-severity vulnerability in Schneider Electric SE Ampla MES, published on 18 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
Weakness: CWE-326
Which versions are affected by CVE-2017-9635?
It affects 1 product.
Products include Schneider-Electric Ampla Manufacturing Execution System.
How do I fix CVE-2017-9635?
No fix has been published for CVE-2017-9635 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-9635 being exploited?
There is no known exploitation of CVE-2017-9635 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric SE Ampla MES
Sources
Also known as GHSA-cfpr-7wg7-7x58.