CVE-2014-5399

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Schneider Electric	Wonderware Information Server Portal	4.0 SP1; 4.5; 5.0; 5.5

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02
http://www.securityfocus.com/bid/69416
https://ics-cert.us-cert.gov/advisories/ICSA-14-238-02Third Party Advisory, US Government Resource

Timeline

Published: Aug 28, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-54002.1The installation component in Hospira MedNet before 6.1 places cleartext credentials in configuration files, which allows local users to obt CVE-2014-54019.8Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow CVE-2014-54035.0Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote att CVE-2014-54059.0Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users CVE-2014-54069.3The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) softwa CVE-2014-54074.4Multiple stack-based buffer overflows in Schneider Electric VAMPSET 2.2.136 and earlier allow local users to cause a denial of service (appl CVE-2014-54084.3Cross-site scripting (XSS) vulnerability in the login script in the Wind Farm Portal on Nordex Control 2 (NC2) SCADA devices 15 and earlier CVE-2014-54095.0The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for T CVE-2014-54107.1The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN CVE-2014-54113.5Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow CVE-2014-54125.0Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allows remote attackers to read database records by leveragi CVE-2014-54135.0Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes