CVE-2014-9198
Schneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | Critical10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| NVDNVD · Modified | 2.0 | High10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 4.2% · top 9.0% of all CVEs (4 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.
Weakness
Affected products
Schneider Electric · ETG3000 FactoryCast HMI Gateway
- affected TSXETG3000
- affected TSXETG3010
- affected TSXETG3021
- affected TSXETG3022
What to do
Solution: Schneider Electric has produced an updated firmware, labelled V1.60 IR 04. This firmware release moves the jar files directory in a secure area. The new firmware also includes the ability to disable the FTP server. This updated firmware can be downloaded at: http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/?showAsIframe... http://www.schneider-electric.com/download/WW/EN/details/681790255-TSXETG30xx-V160-IR4/
Workaround: Schneider Electric recommends the FTP server be deactivated when not needed. The firmware update does not remove the hard-coded credentials. Narendra Shinde also found that configuration files were accessible using default credentials. Schneider Electric recommends users change the default login credentials. This will protect configuration files from unauthorized access.
References (4)
- https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02 (opens in a new tab)
- https://ics-cert.us-cert.gov/advisories/ICSA-15-020-02 (opens in a new tab)x_refsource_MISCx_transferred
- 72258 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 77765 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2014-9198)Record last updated .