What’s Vulnerable › Vulnerabilities

CVE-2014-9198: Schneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-01-27 · updated 2026-06-17
• Weakness: CWE-798

Description

The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

Affected products

• Schneider-Electric Etg3000 Factorycast Hmi Gateway Firmware: through 1.60.4
• Schneider-Electric Tsxetg3000: all versions
• Schneider-Electric Tsxetg3010: all versions
• Schneider-Electric Tsxetg3021: all versions
• Schneider-Electric Tsxetg3022: all versions

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02
• http://www.securityfocus.com/bid/72258
• http://www.securityfocus.com/bid/77765
• https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02

Get alerted when CVE-2014-9198 or the next vulnerability affects your stack