CVE-2014-9197 - CVE House

Back to Database

Status published Critical CVE-2014-9197

Schneider Electric ETG3000 FactoryCast HMI Gateway Missing Authentication for Critical Function

10 CVSS

Vulnerability Description

The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-9197

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Narendra Shinde of Qualys Security

References

https://www.cisa.gov/news-events/ics-advisories/icsa-15-020-02

More from Schneider Electric

View All →

CWE-78: Improper Neutralization of Special Elements used in an OS...

CWE-78: Improper Neutralization of Special Elements used in an OS...

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege...

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site...

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists...

Affected Vendor

Schneider Electric

View all reports →

Affected Software

ETG3000 FactoryCast HMI Gateway

Vulnerable Versions:

TSXETG3000, TSXETG3010, TSXETG3021, TSXETG3022

Timeline

Official Publish: January 27th, 2015

Last Modified: September 5th, 2025

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1136 Create Account

T1098 Account Manipulation

Privilege Escalation

T1021 Remote Services

Lateral Movement