Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-9635: Schneider Electric Ampla MES passwords can be cracked

CVE-2017-9635 · published 8 years ago

Summary

The Ampla MES version 6.4 system stores user passwords using a weak method that can be reversed, allowing an attacker to discover clear‑text passwords. This puts any accounts using the Simple Security setting at risk of unauthorized access. Upgrade to Ampla MES version 6.5 as soon as possible to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
schneider-electric	ampla_manufacturing_execution_system	<= 6.4 `cpe:2.3:a:schneider-electric:ampla_manufacturing_execution_system::::::::`

Original advisory text

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.

References

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/ Vendor Advisory
http://www.securityfocus.com/bid/99469 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05 Third Party Advisory US Government Resource

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

3.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-326Inadequate Encryption Strength

Timeline

Published18 May 2018

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-9635 · NVD

Track software like this

Free during beta