Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
| Link | Tags |
|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05 | third party advisory us government resource |
| http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/ | vendor advisory |
| http://www.securityfocus.com/bid/99469 | vdb entry third party advisory |