CVEvulnerability

CVE-2017-5178

9.8 CRITICAL Published 2017-03-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-03-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-1188

Description

An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Directory), the software is not vulnerable. However, when Tableau Server is used with local authentication mode, the software is vulnerable. The default system account could be used to gain unauthorized access.

Affected configurations

• schneider-electric tableau desktop 7.0 • schneider-electric tableau desktop 10.1.3 • schneider-electric tableau server 7.0 • schneider-electric tableau server 10.1.3 • schneider-electric wonderware intelligence (<= 2014)

Related

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References