← Vulnerability feed

Vulnerability record · CVE-2015-0997 · published 29 March 2015

CVE-2015-0997: Aveva edge information exposure vulnerability

Aveva · Aveva Edge

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.

5.0 CVSS 2.0 Medium EPSS 2.4% · top 16.8% CWE-200 · Information exposure
5.0CVSS 2.0 base score
2.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 PatchVendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 PatchVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Third Party AdvisoryUS Government Resource
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 PatchVendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 PatchVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Third Party AdvisoryUS Government Resource

Track CVE-2015-0997 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2022-28685Aveva edge deserialization of untrusted data vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 17%7.8CVE-2022-28686Aveva edge uncontrolled search path element vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 0.65%7.8CVE-2022-28687Aveva edge uncontrolled search path element vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 0.98%7.8CVE-2022-28688Aveva edge uncontrolled search path element vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). U…EPSS 0.65%7.8CVE-2022-36970Aveva edge vulnerabilityThis vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service …EPSS 0.65%7.1CVE-2022-36969Aveva edge xml external entity (xxe) vulnerabilityThis vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.…EPSS 14%3.3CVE-2015-0998Aveva edge information exposure vulnerabilitySchneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext cred…EPSS 0.77%2.1CVE-2015-0999Aveva edge information exposure vulnerabilitySchneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC Use…EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2015-0997), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.