Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · Complete
- Fix status
- Fixed
Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Why it matters now
EPSS 0.01287 70th percentileScored 2026-11-07
Fix Fixed ClearSCADA (Schneider Electric): 2010 R3.2SCADA Expert ClearSCADA (Schneider Electric): 2014 R1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schneider Electric | ClearSCADA | 2010 R3 (build 72.4560); 2010 R3.1 (build 72.4644) | 2010 R3.2 | Patch available | CNA |
| Schneider Electric | SCADA Expert ClearSCADA | 2013 R1 (build 73.4729); 2013 R1.1 (build 73.4832); 2013 R1.1a (build 73.4903); 2013 R1.2 (build 73.4955); 2013 R2 (build 74.5094); 2013 R2.1 (build 74.5192); 2014 R1 (build 75.5210) | 2014 R1.1 | Patch available | CNA |
- ClearSCADA VendorSchneider Electric Affected 2010 R3 (build 72.4560); 2010 R3.1 (build 72.4644) Fixed in 2010 R3.2 Patch available CNA
- SCADA Expert ClearSCADA VendorSchneider Electric Affected 2013 R1 (build 73.4729); 2013 R1.1 (build 73.4832); 2013 R1.1a (build 73.4903); 2013 R1.2 (build 73.4955); 2013 R2 (build 74.5094); 2013 R2.1 (build 74.5192); 2014 R1 (build 75.5210) Fixed in 2014 R1.1 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aveva:clearscada:2010:r3:*:*:*:*:*:* | 2010 r3 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:clearscada:2010:r3.1:*:*:*:*:*:* | 2010 r3.1 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:clearscada:2013:r1:*:*:*:*:*:* | 2013 r1 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:clearscada:2013:r1.1:*:*:*:*:*:* | 2013 r1.1 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:clearscada:2013:r1.1a:*:*:*:*:*:* | 2013 r1.1a | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:clearscada:2013:r1.2:*:*:*:*:*:* | 2013 r1.2 | Vulnerable | AVEVA |
| cpe:2.3:a:aveva:clearscada:2013:r2:*:*:*:*:*:* | 2013 r2 | Vulnerable | AVEVA |
| cpe:2.3:a:schneider-electric:scada_expert_clearscada:2013:r2.1:*:*:*:*:*:* | 2013 r2.1 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:scada_expert_clearscada:2014:r1:*:*:*:*:*:* | 2014 r1 | Vulnerable | Schneider Electric |
- cpe:2.3:a:aveva:clearscada:2010:r3:*:*:*:*:*:* Versions 2010 r3 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:clearscada:2010:r3.1:*:*:*:*:*:* Versions 2010 r3.1 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:clearscada:2013:r1:*:*:*:*:*:* Versions 2013 r1 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:clearscada:2013:r1.1:*:*:*:*:*:* Versions 2013 r1.1 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:clearscada:2013:r1.1a:*:*:*:*:*:* Versions 2013 r1.1a Vulnerable ·AVEVA
- cpe:2.3:a:aveva:clearscada:2013:r1.2:*:*:*:*:*:* Versions 2013 r1.2 Vulnerable ·AVEVA
- cpe:2.3:a:aveva:clearscada:2013:r2:*:*:*:*:*:* Versions 2013 r2 Vulnerable ·AVEVA
- cpe:2.3:a:schneider-electric:scada_expert_clearscada:2013:r2.1:*:*:*:*:*:* Versions 2013 r2.1 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:scada_expert_clearscada:2014:r1:*:*:*:*:*:* Versions 2014 r1 Vulnerable ·Schneider Electric
Remediation
- Fix · CNA ClearSCADA (Schneider Electric) Fixed in 2010 R3.2
- Fix · CNA SCADA Expert ClearSCADA (Schneider Electric) Fixed in 2014 R1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2014-5411
- 2026-10-03 Alias added: GHSA-36cr-x5x9-99f3
References
More Schneider Electric Scada Expert Clearscada vulnerabilities
- TI-2014-04412 Schneider Electric SCADA Expert ClearSCADA Improper Authentication CVSS 2.0MEDIUM 6.4
- TI-2014-04413 Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues CVSS 2.0MEDIUM 6.4
Sources
- CVE-2014-5411 · CVE Program
- CVE-2014-5411 · NVD
- FIRST EPSS
- GHSA-36cr-x5x9-99f3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences