Vulnerability Description
Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Struxureware Building Expert Multi-Purpose Management | < 2.15 |
Related Weaknesses (CWE)
References
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-254-01Broken LinkVendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01Third Party AdvisoryUS Government Resource
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-254-01Broken LinkVendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2015-3962?
CVE-2015-3962 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...
How severe is CVE-2015-3962?
CVE-2015-3962 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-3962?
Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Struxureware Building Expert Multi-Purpose Management.