- 10.0CriticalCVSS base score
- 4.2%Exploitation in 30 daysEPSS · top 9.0% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.
Timeline
ID reserved
By icscert
- 56 days later
· 56 days later
Published
- 11 years later
· 11 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | Critical10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| NVDNVD · Modified | 2.0 | High10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 4.2% · top 9.0% of all CVEs (9 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.
Affected products
Schneider Electric · ETG3000 FactoryCast HMI Gateway
- affected TSXETG3000
- affected TSXETG3010
- affected TSXETG3021
- affected TSXETG3022
What to do
Solution: Schneider Electric has produced an updated firmware, labelled V1.60 IR 04. This firmware release moves the jar files directory in a secure area. The new firmware also includes the ability to disable the FTP server. This updated firmware can be downloaded at: http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/?showAsIframe... http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/
Workaround: Schneider Electric recommends the FTP server be deactivated when not needed. The firmware update does not remove the hard-coded credentials. Narendra Shinde also found that configuration files were accessible using default credentials. Schneider Electric recommends users change the default login credentials. This will protect configuration files from unauthorized access.
References
4
- https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02 (opens in a new tab)
- https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02 (opens in a new tab)x_refsource_MISCx_transferred
- 72258 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 77765 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2014-9023 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2014-9198)Record last updated .