CVE-2017-9635

Severity: low (CVSS 3.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-18 · updated 2026-06-17
Weakness: CWE-326

Description

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.

Affected products

Schneider Electric SE Ampla MES: through 6.4

References

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
http://www.securityfocus.com/bid/99469
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
http://www.securityfocus.com/bid/99469
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05

Get alerted when CVE-2017-9635 or the next vulnerability affects your stack