What’s Vulnerable › Vulnerabilities

CVE-2014-9197: Schneider Electric ETG3000 FactoryCast HMI Gateway Missing Authentication for Critical Function

• Severity: high (CVSS 7.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-01-27 · updated 2026-06-17
• Weakness: CWE-306

Description

The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

Affected products

• Schneider-Electric Etg3000 Factorycast Hmi Gateway Firmware: 1.60.2
• Schneider-Electric Tsxetg3000: all versions
• Schneider-Electric Tsxetg3010: all versions
• Schneider-Electric Tsxetg3021: all versions
• Schneider-Electric Tsxetg3022: all versions

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02
• https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02

Get alerted when CVE-2014-9197 or the next vulnerability affects your stack