CVE-2015-7914

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-254 CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2016/Feb/25
https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01Third Party Advisory, US Government Resource
http://seclists.org/fulldisclosure/2016/Feb/25
https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01Third Party Advisory, US Government Resource

Timeline

Published: Feb 6, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-79159.8Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information b CVE-2015-79166.5Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbi CVE-2015-79177.2Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Tro CVE-2015-79186.8Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers CVE-2015-791910.0SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application cra CVE-2015-79219.1The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.CVE-2015-79239.0Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-mi CVE-2015-79248.8eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes CVE-2015-79258.0Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentic CVE-2015-79269.9eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain s CVE-2015-79276.1Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script CVE-2015-79288.5eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote at