- 7.8HighCVSS base score
- 0.75%Exploitation in 30 daysEPSS · top 45% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.
Timeline
ID reserved
By icscert
- 6 months later
· 6 months later
Published
- 11 years later
· 11 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | High7.8 | AV:N/AC:L/Au:N/C:C/I:N/A:N |
| NVDNVD · Modified | 2.0 | High7.8 | AV:N/AC:L/Au:N/C:C/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.75% · top 45% of all CVEs (9 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
Schneider Electric · Wonderware Information Server Portal
- affected 4.0 SP1
- affected 4.5
- affected 5.0
- affected 5.5
What to do
Solution: Schneider Electric has created an update for WIS web pages and components to address the vulnerabilities listed in this advisory. Customers using all versions of WIS are affected and should upgrade to WIS Version 5.5 and then apply the security update. Customers using the affected versions of WIS should set the security level settings in the Internet browser to “Medium – High” to minimize the risks presented by these vulnerabilities. In addition, the Wonderware Information Server Portal can be configured to use HTTPS that will require additional steps as documented in the products user documentation. Schneider Electric has released a security bulletin titled “Multiple Vulnerabilities in Wonderware Information Server LFSEC00000102” to announce the security update, which is available at the following location: https://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000102.pdf
References
3
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2014-2417 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2014-2380)Record last updated .