Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues

Description

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm.

Scores

EPSS (exploitation in 30 days)

1.0% · top 36% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Weakness

• CWE-310 (opens in a new tab)All about CWE-310 and its CVEs

Affected products

• Schneider Electric · ClearSCADA

  • affected 2010 R3 (build 72.4560)
  • affected 2010 R3.1 (build 72.4644)
  • unaffected 2010 R3.2

• Schneider Electric · SCADA Expert ClearSCADA

  • affected 2013 R1 (build 73.4729)
  • affected 2013 R1.1 (build 73.4832)
  • affected 2013 R1.1a (build 73.4903)
  • affected 2013 R1.2 (build 73.4955)
  • affected 2013 R2 (build 74.5094)
  • affected 2013 R2.1 (build 74.5192)
  • affected 2014 R1 (build 75.5210)
  • unaffected 2014 R1.1

What to do

Solution: Asset owners should always obtain a signed web certificate from a certified authority before deploying ClearSCADA Web Server in a production environment. To assist asset owners who are currently using self-signed certificates, a standalone utility will be made available that can be used to generate and deploy a new self-signed certificate (signed using an SHA signing algorithm). This utility is recommended for existing ClearSCADA systems subject to this vulnerability, removing the need to upgrade the ClearSCADA software and perform a manual generation of a new certificate. This utility will be made available within the Software Downloads section of the following ClearSCADA Resource Center page: http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support

References (3)

• https://www.cisa.gov/news-events/ics-advisories/icsa-14-259-01a (opens in a new tab)
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-259-01a.json (opens in a new tab)
• https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2014-5413](https://trackcve.app/badge/CVE-2014-5413.svg)](https://trackcve.app/cve/CVE-2014-5413)

Record last updated 4 Nov 2025, 22:59 UTC.