// Description
Schneider Electric Security Notification
11-Aug-20 (13-Aug-20) Document Reference Number – SEVD-2020 -224-08 V1.1 Page 1 of 3
## Schneider Electric PACTware (V1.1)
11 August 2020 (13 August 2020)
## Overview
Schneider Electric is aware of multiple vulnerabilities in the PACTware product.
## Affected Product(s)
Schneider Electric PACTware V5.0.5.30 and prior.
Schneider Electric PACTware V4.1 SP5 and prior.
## Vulnerability Details
CVE ID: CVE-2020-9403
CVSS v3.0 Base Score 5.5 | Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable format, and may be retrieved by any user with access to the PACTware workstation.
CVE ID: CVE-2020-9404
CVSS v3.0 Base Score 7.1 | High | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H|
In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by an attacker with no knowledge of the current passwords.
## Remediation
This vulnerability is fixed in versions V4.1 SP6a and V5.0.5.31 available for download below:
4.1 SP6a is available through Global Customer Support site as TD70270673 at:
https://pasupport.schneider-electric.com/qfdb/qfdisplay/search/searchresultframe.asp?QuickFixName=HF70270673&chkSh owSuperseded=on
V5.0.5.31 is available at:
https://www.se.com/ww/en/download/document/FD-SOFT-M-026/ Schneider Electric Security Notification
11-Aug-20 (13-Aug-20) Document Reference Number – SEVD-2020 -224-08 V1.1 Page 2 of 3
## Product Information
PACTware is a software application for easy operation of automation field devices.
Product Category - Industrial Automation Control
Learn more about Schneider Electric’s product categories here: www.se.us/en/all-products .
How to determine if you are affected