Read the docs
TI-2014-04412 Aliases CVE-2014-5412GHSA-q6fc-f6x3-vfx6

Schneider Electric SCADA Expert ClearSCADA Improper Authentication

Priority LOW 32CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allows remote attackers to read database records by leveraging access to the guest account.

Why it matters now

EPSS 0.01572 75th percentileScored 2026-11-07
Fix Fixed ClearSCADA (Schneider Electric): 2010 R3.2SCADA Expert ClearSCADA (Schneider Electric): 2014 R1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricClearSCADA2010 R3 (build 72.4560); 2010 R3.1 (build 72.4644)2010 R3.2Patch availableCNA
Schneider ElectricSCADA Expert ClearSCADA2013 R1 (build 73.4729); 2013 R1.1 (build 73.4832); 2013 R1.1a (build 73.4903); 2013 R1.2 (build 73.4955); 2013 R2 (build 74.5094); 2013 R2.1 (build 74.5192); 2014 R1 (build 75.5210)2014 R1.1Patch availableCNA
  • ClearSCADA VendorSchneider Electric Affected 2010 R3 (build 72.4560); 2010 R3.1 (build 72.4644) Fixed in 2010 R3.2 Patch available CNA
  • SCADA Expert ClearSCADA VendorSchneider Electric Affected 2013 R1 (build 73.4729); 2013 R1.1 (build 73.4832); 2013 R1.1a (build 73.4903); 2013 R1.2 (build 73.4955); 2013 R2 (build 74.5094); 2013 R2.1 (build 74.5192); 2014 R1 (build 75.5210) Fixed in 2014 R1.1 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:aveva:clearscada:2010:r3:*:*:*:*:*:*2010 r3VulnerableAVEVA
cpe:2.3:a:aveva:clearscada:2010:r3.1:*:*:*:*:*:*2010 r3.1VulnerableAVEVA
cpe:2.3:a:aveva:clearscada:2013:r1:*:*:*:*:*:*2013 r1VulnerableAVEVA
cpe:2.3:a:aveva:clearscada:2013:r1.1:*:*:*:*:*:*2013 r1.1VulnerableAVEVA
cpe:2.3:a:aveva:clearscada:2013:r1.1a:*:*:*:*:*:*2013 r1.1aVulnerableAVEVA
cpe:2.3:a:aveva:clearscada:2013:r1.2:*:*:*:*:*:*2013 r1.2VulnerableAVEVA
cpe:2.3:a:aveva:clearscada:2013:r2:*:*:*:*:*:*2013 r2VulnerableAVEVA
cpe:2.3:a:schneider-electric:scada_expert_clearscada:2013:r2.1:*:*:*:*:*:*2013 r2.1VulnerableSchneider Electric
cpe:2.3:a:schneider-electric:scada_expert_clearscada:2014:r1:*:*:*:*:*:*2014 r1VulnerableSchneider Electric
  • cpe:2.3:a:aveva:clearscada:2010:r3:*:*:*:*:*:* Versions 2010 r3 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:clearscada:2010:r3.1:*:*:*:*:*:* Versions 2010 r3.1 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:clearscada:2013:r1:*:*:*:*:*:* Versions 2013 r1 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:clearscada:2013:r1.1:*:*:*:*:*:* Versions 2013 r1.1 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:clearscada:2013:r1.1a:*:*:*:*:*:* Versions 2013 r1.1a Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:clearscada:2013:r1.2:*:*:*:*:*:* Versions 2013 r1.2 Vulnerable ·AVEVA
  • cpe:2.3:a:aveva:clearscada:2013:r2:*:*:*:*:*:* Versions 2013 r2 Vulnerable ·AVEVA
  • cpe:2.3:a:schneider-electric:scada_expert_clearscada:2013:r2.1:*:*:*:*:*:* Versions 2013 r2.1 Vulnerable ·Schneider Electric
  • cpe:2.3:a:schneider-electric:scada_expert_clearscada:2014:r1:*:*:*:*:*:* Versions 2014 r1 Vulnerable ·Schneider Electric

Remediation

  • Fix · CNA ClearSCADA (Schneider Electric) Fixed in 2010 R3.2
  • Fix · CNA SCADA Expert ClearSCADA (Schneider Electric) Fixed in 2014 R1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-5412
  2. 2026-10-03 Alias added: GHSA-q6fc-f6x3-vfx6

References

Advisory 1

Other 2

  • TI-2014-04413 Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues CVSS 2.0MEDIUM 6.4
  • TI-2014-04411 Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting CVSS 2.0MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences