PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5155 Schneider Electric CVE debrief

CVE-2017-5155 affects Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. The NVD record and referenced vendor/ICS-CERT advisories state that Wonderware Historian creates logins with default passwords, which can let a malicious entity compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may also be compromised. The supplied CVSS is 7.3 (HIGH), and the vector indicates network reachability with no privileges or user interaction required.

Vendor
Schneider Electric
Product
Wonderware Historian
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-24
Original CVE updated
2017-01-24
Advisory published
2017-01-24
Advisory updated
2017-01-24

Who should care

Administrators and operators of Schneider Electric Wonderware Historian deployments, especially OT/ICS teams, Windows and database administrators, and asset owners responsible for affected Historian servers or connected resources.

Technical summary

The issue is a default-password condition in accounts created by Wonderware Historian. The NVD record maps the affected scope to Wonderware Historian 2014 R2 SP1 P01 and earlier. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, the exposure is treated as remotely reachable without prior authentication. The practical risk is unauthorized access to Historian databases and, depending on the installation, adjacent resources.

Defensive priority

High

Recommended defensive actions

  • Follow the Schneider Electric vendor bulletin and ICS-CERT advisory for the product-specific remediation path.
  • Replace any default passwords on Historian-created logins with unique, strong credentials.
  • Audit Historian accounts, database permissions, and related service credentials for unexpected or shared defaults.
  • Restrict network access to Historian and its database components to trusted administrative and OT management segments.
  • Review logs and access history for signs of unauthorized database or resource access.
  • Apply vendor-recommended updates or compensating controls for affected versions before returning the system to normal trust.

Evidence notes

Source corpus evidence comes from the official NVD record, which states the issue is that Wonderware Historian creates logins with default passwords and identifies affected versions as 2014 R2 SP1 P01 and earlier. The same record provides the CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L and lists the vulnerable CPE for Schneider Electric Wonderware Historian. The supplied enrichment marks this CVE as not in CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5155 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5155

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5155 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5155

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.