Improper input validation in Schneider Electric ClearSCADA
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schneider Electric | ClearSCADA | 2014 R1 (build 75.5210) and prior; 2014 R1.1 (build 75.5387) and prior; 2015 R1 (build 76.5648) and prior; 2015 R2 (build 77.5882) and prior | — | No fix listed | CNA |
- ClearSCADA VendorSchneider Electric Affected 2014 R1 (build 75.5210) and prior; 2014 R1.1 (build 75.5387) and prior; 2015 R1 (build 76.5648) and prior; 2015 R2 (build 77.5882) and prior Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aveva:clearscada:*:*:*:*:*:*:*:* | up to 2010 | Vulnerable | AVEVA |
| cpe:2.3:a:schneider-electric:clearscada:2014:r1:*:*:*:*:*:* | 2014 r1 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:clearscada:2014:r1.1:*:*:*:*:*:* | 2014 r1.1 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:clearscada:2015:r1:*:*:*:*:*:* | 2015 r1 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:clearscada:2015:r2:*:*:*:*:*:* | 2015 r2 | Vulnerable | Schneider Electric |
- cpe:2.3:a:aveva:clearscada:*:*:*:*:*:*:*:* Versions up to 2010 Vulnerable ·AVEVA
- cpe:2.3:a:schneider-electric:clearscada:2014:r1:*:*:*:*:*:* Versions 2014 r1 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:clearscada:2014:r1.1:*:*:*:*:*:* Versions 2014 r1.1 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:clearscada:2015:r1:*:*:*:*:*:* Versions 2015 r1 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:clearscada:2015:r2:*:*:*:*:*:* Versions 2015 r2 Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6021
- 2026-10-03 Alias added: GHSA-xc24-4mjv-9pwv
References
More Schneider Electric Clearscada vulnerabilities
- TI-2022-08201 Improper check for unusual conditions in ClearSCADA , EcoStruxure Geo SCADA Expert 2019… CVSS 3.1HIGH 7.5
- TI-2022-08198 A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause… CVSS 3.1HIGH 7.5
- TI-2019-04887 Improper authentication in EcoStruxure Geo SCADA Expert with initial releases before 1… CVSS 3.1HIGH 7.8
- TI-2023-00564 Improper output encoding in Schneider Electric EcoStruxure Geo SCADA Expert 2019 CVSS 3.1MEDIUM 5.3
- TI-2021-05622 Use of Password Hash with Insufficient Computational Effort vulnerability exists in… CVSS 3.1MEDIUM 6.7
- TI-2022-08200 Improper certificate validation in ClearSCADA , EcoStruxure Geo SCADA Expert 2019… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2017-6021 · CVE Program
- CVE-2017-6021 · NVD
- FIRST EPSS
- GHSA-xc24-4mjv-9pwv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences