← Vulnerability feed

Vulnerability record · CVE-2015-0996 · published 29 March 2015

CVE-2015-0996: Aveva edge information exposure vulnerability

Aveva · Aveva Edge

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.

2.1 CVSS 2.0 Low EPSS 0.37% · top 70.8% CWE-200 · Information exposure
2.1CVSS 2.0 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.

AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 PatchVendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 PatchVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Third Party AdvisoryUS Government Resource
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 PatchVendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 PatchVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Third Party AdvisoryUS Government Resource

Track CVE-2015-0996 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2022-28687Aveva edge uncontrolled search path element vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 0.98%7.8CVE-2022-28685Aveva edge deserialization of untrusted data vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 17%7.8CVE-2022-36970Aveva edge vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service …EPSS 0.65%7.8CVE-2022-28688Aveva edge uncontrolled search path element vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 0.65%7.8CVE-2022-28686Aveva edge uncontrolled search path element vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 0.65%7.1CVE-2022-36969Aveva edge xml external entity (xxe) vulnerabilityThis vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.…EPSS 14%5.0CVE-2015-0997Aveva edge information exposure vulnerabilitySchneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user int…EPSS 2.4%3.3CVE-2015-0998Aveva edge information exposure vulnerabilitySchneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext cred…EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2015-0996), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.