CVE-2015-0998: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7...

Security readout for executives and security teams

Affected Schneider Electric InduSoft Web Studio and InTouch Machine Edition versions send credentials in clear text. An attacker who can observe the relevant network traffic could capture those credentials and use them for unauthorized access. This matters most in OT networks where these tools manage industrial systems. Exposure is likely limited to environments running the affected Schneider Electric products and transmitting credentials over observable network paths. Risk increases on shared, poorly segmented, vendor-accessible, wireless, or otherwise untrusted OT networks. Treat as a targeted OT hygiene issue. It is not listed as actively exploited in the provided sources, but cleartext credential exposure can enable broader compromise if affected systems remain on observable network paths. Mitigation focus: Upgrade affected products to 7.1.3.4 SP3 Patch 4 or later where applicable.; Review Schneider Electric and CISA ICS advisory guidance before changing OT systems.; Restrict access to networks carrying HMI or engineering workstation traffic..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.