PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5155 Schneider Electric CVE debrief

CVE-2017-5155 affects Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. The NVD record and referenced vendor/ICS-CERT advisories state that Wonderware Historian creates logins with default passwords, which can let a malicious entity compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may also be compromised. The supplied CVSS is 7.3 (HIGH), and the vector indicates network reachability with no privileges or user interaction required.

Vendor
Schneider Electric
Product
CVE-2017-5155
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-13
Original CVE updated
2026-05-13
Advisory published
2017-02-13
Advisory updated
2026-05-13

Who should care

Administrators and operators of Schneider Electric Wonderware Historian deployments, especially OT/ICS teams, Windows and database administrators, and asset owners responsible for affected Historian servers or connected resources.

Technical summary

The issue is a default-password condition in accounts created by Wonderware Historian. The NVD record maps the affected scope to Wonderware Historian 2014 R2 SP1 P01 and earlier. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, the exposure is treated as remotely reachable without prior authentication. The practical risk is unauthorized access to Historian databases and, depending on the installation, adjacent resources.

Defensive priority

High

Recommended defensive actions

  • Follow the Schneider Electric vendor bulletin and ICS-CERT advisory for the product-specific remediation path.
  • Replace any default passwords on Historian-created logins with unique, strong credentials.
  • Audit Historian accounts, database permissions, and related service credentials for unexpected or shared defaults.
  • Restrict network access to Historian and its database components to trusted administrative and OT management segments.
  • Review logs and access history for signs of unauthorized database or resource access.
  • Apply vendor-recommended updates or compensating controls for affected versions before returning the system to normal trust.

Evidence notes

Source corpus evidence comes from the official NVD record, which states the issue is that Wonderware Historian creates logins with default passwords and identifies affected versions as 2014 R2 SP1 P01 and earlier. The same record provides the CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L and lists the vulnerable CPE for Schneider Electric Wonderware Historian. The supplied enrichment marks this CVE as not in CISA KEV.

Official resources

CVE published by NVD on 2017-02-13T21:59:02.737Z. This debrief uses the published CVE date for timing context and does not treat the later NVD modification date as the issue date.