Skip to content
Fencer Vulns
critical 9.8

CVE-2017-5178 in the critical feed json

An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and…

published 2017-03-08 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-14287

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
13.6%
EPSS 13.6% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Directory), the software is not vulnerable. However, when Tableau Server is used with local authentication mode, the software is vulnerable. The default system account could be used to gain unauthorized access.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-17-066-01 updated cvss 9.8

ICSA-17-066-01_Schneider Electric Wonderware Intelligence

  • Schneider Electric Software, LLC Tableau Server/Desktop >= 7.0, <= 10.1.3 and Wonderware Intelligence <= 2014R3
    affected: mitigation “The Schneider Electric customers using Wonderware Intelligence can login at the following support sites to download the Tableau patches:” gcsresource.invensys.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

13.63% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a Schneider Electric Wonderware Intelligence 2014R3 and prior

Classification

Weakness
  • CWE-1188 Initialization of a Resource with an Insecure Default

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.