Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
  • Support the projectPage
Back

CVE-2014-5413

Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues

Description

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm.

Timeline

  1. ID reserved

    By icscert

  2. · 27 days later

    Published

  3. · 11 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2014-5413, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)2.0Medium6.4AV:N/AC:L/Au:N/C:P/I:P/A:N
NVDNVD · Modified2.0Medium5.0AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS (exploitation in 30 days)
1.0% · top 36% of all CVEs (10 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Affected products

  • Schneider Electric · ClearSCADA

    • affected 2010 R3 (build 72.4560)
    • affected 2010 R3.1 (build 72.4644)
    • unaffected 2010 R3.2

  • Schneider Electric · SCADA Expert ClearSCADA

    • affected 2013 R1 (build 73.4729)
    • affected 2013 R1.1 (build 73.4832)
    • affected 2013 R1.1a (build 73.4903)
    • affected 2013 R1.2 (build 73.4955)
    • affected 2013 R2 (build 74.5094)
    • affected 2013 R2.1 (build 74.5192)
    • affected 2014 R1 (build 75.5210)
    • unaffected 2014 R1.1

What to do

Solution: Asset owners should always obtain a signed web certificate from a certified authority before deploying ClearSCADA Web Server in a production environment. To assist asset owners who are currently using self-signed certificates, a standalone utility will be made available that can be used to generate and deploy a new self-signed certificate (signed using an SHA signing algorithm). This utility is recommended for existing ClearSCADA systems subject to this vulnerability, removing the need to upgrade the ClearSCADA software and perform a manual generation of a new certificate. This utility will be made available within the Software Downloads section of the following ClearSCADA Resource Center page: http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support

References

3

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2014-5413 badge
[![CVE-2014-5413](https://cveledger.app/badge/CVE-2014-5413.svg)](https://cveledger.app/cve/CVE-2014-5413)

Record last updated .