You are here

Home

ICS-CERT Advisory: Schneider Electric Wonderware OpenSSL Vulnerability (ICSA-14-135-02, May 15, 2014)

ICS-CERT Advisory: Schneider Electric Wonderware OpenSSL Vulnerability (ICSA-14-135-02, May 15, 2014)

Created: Friday, May 16, 2014 - 11:39
Categories:
Cybersecurity

Schneider Electric Wonderware’s Cyber Security Team has identified an OpenSSL Heartbleed vulnerability in the Wonderware Intelligence application, caused by a third-party component. Schneider Electric Wonderware has produced a patch that mitigates this vulnerability. This vulnerability could be exploited remotely. Exploits that target this vulnerability are known to be publicly available.

AFFECTED PRODUCTS

The latest release of Schneider Electric Wonderware Intelligence Version 1.5 SP1 is not susceptible to the OpenSSL vulnerability. However, users have been known to reinstall Tableau Server, the vulnerable third-party component that is affected. Therefore, Schneider Electric Wonderware has issued a patch and a security bulletin addressing this vulnerability in all versions.

Tableaua has been identified as the third-party component vendor that has product vulnerable to the OpenSSL Heartbleed bug. The following Tableau products susceptible to the OpenSSL vulnerability used in the Schneider Electric Wonderware Intelligence product are:

  • Tableau Server ver 8.0.6 through 8.0.9
  • ​Tableau Server ver 8.1.0 through 8.1.5.

Read ICS-CERT Advisory14-135-02.

Visit WaterISAC's OpenSSL page with previously reported updates and resources.