CVE-2014-9198

The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

Score

CVSS 2.0 10.0 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2015-01-27

Last modified

2025-09-05

Weaknesses

CWE-255, CWE-798

Affected products

• Etg3000 Factorycast Hmi Gateway Firmware (Schneider-electric)
• Tsxetg3000 (Schneider-electric)
• Tsxetg3010 (Schneider-electric)
• Tsxetg3021 (Schneider-electric)
• Tsxetg3022 (Schneider-electric)
• Etg3000 Factorycast Hmi Gateway (Schneider Electric)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02
• http://www.securityfocus.com/bid/72258
• http://www.securityfocus.com/bid/77765
• https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02