Vulnerability record · CVE-2015-1014 · published 25 March 2019

CVE-2015-1014: Schneider-electric opc factory server uncontrolled search path element vulnerability

Schneider Electric · Opc Factory Server

A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version.

7.3 CVSS 3.0 High EPSS 0.46% · top 63.0% CWE-427 · Uncontrolled search path element

7.3CVSS 3.0 base score, v2 4.4

0.46%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Opc Factory Server Schneider Electric

References

Link	Tags
https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01	MitigationThird Party AdvisoryUS Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01	MitigationThird Party AdvisoryUS Government Resource

Track CVE-2015-1014 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2013-0662Schneider-electric concept out-of-bounds write vulnerabilityMultiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute …EPSS 22%1 Apr 2014 7.2CVE-2011-3330Schneider-electric monitor pro memory buffer overflow vulnerabilityBuffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect …EPSS 1.3%4 Nov 2011 6.8CVE-2014-0774Schneider-electric ofs test client tlxcdlfofs33 stack-based buffer overflow vulnerabilityStack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLU…EPSS 0.47%28 Feb 2014 5.5CVE-2023-2161Schneider-electric opc factory server xml external entity (xxe) vulnerabilityA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system wh…EPSS 0.17%16 May 2023 7.8CVE-2020-3433Cisco AnyConnect Windows client DLL hijacking via IPC channelCisco AnyConnect Secure Mobility Client for Windows fails to properly validate resources loaded at run time, allowing a DLL hijacking attack through …KEVEPSS 10%analysed17 Aug 2020 6.5CVE-2020-3153Cisco AnyConnect Windows Installer Path Handling Privilege EscalationThe Cisco AnyConnect Secure Mobility Client for Windows installer mishandles directory paths, letting an authenticated local user copy attacker-suppl…KEVEPSS 28%analysed19 Feb 2020

Source: NIST National Vulnerability Database (record CVE-2015-1014), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.