PT-2015-06: Information Disclosure in Inductive Automation Ignition Vulnerable softwareInductive Automation Ignition Version: 7.7.3 and earlierLink: https://www.inductiveautomation.com/Severity levelSeverity level: Medium Impact: Information Disclosure Access Vector: Remote CVSS v2: Base Score: 5.2 Vector: (AV:N/AC:L/Au:S/C:C/I:N/A:N)CVE: not assignedSoftware descriptionInductive Automation Ignition is a cross-platform HMI, SCADA, and MES solution.Vulnerability descriptionThe specialists of the Positive Research center have detected an Information Disclosure vulnerability in Inductive Automation Ignition.OPC Server username and password stored in clear text.How to fixUpdate your sofware up to the latest versionAdvisory status 12.02.2015 - Vendor gets vulnerability details 09.03.2015 - Vendor releases fixed version and details 11.03.2015 - Public disclosureCreditsThe vulnerability was detected by Ilya Karpov, Positive Research Center (Positive Technologies Company)References http://en.securitylab.ru/lab/PT-2015-06 Reports on the vulnerabilities previously discovered by Positive Research:http://www.ptsecurity.com/research/advisory/ http://en.securitylab.ru/lab/