CVE-2017-5178
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Directory), the software is not vulnerable. However, when Tableau Server is used with local authentication mode, the software is vulnerable. The default system account could be used to gain unauthorized access.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceSchneider Electric Tableau Server versions 7.0-10.1.3 and Wonderware Intelligence 2014R3 contain a hardcoded default system account that cannot be easily reconfigured after installation, and the credential change process is undocumented. When Tableau Server operates in local authentication mode (rather than Windows integrated security/Active Directory), this default account can be exploited for unauthorized access.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 7.0= 10.1.3= 7.0= 10.1.3<= 2014CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed product versionLocate the installed Tableau Server, Tableau Desktop, or Wonderware Intelligence version through the program's About or version information dialog, or check the installed programs list in the operating systemAffected if The installed version is 7.0, 10.1.3, or any version between 7.0 and 10.1.3 for Tableau products, or 2014 or earlier for Wonderware Intelligence
-
Determine authentication mode configurationAccess the Tableau Server or Wonderware Intelligence administration console or configuration settings and locate the authentication mode settingAffected if The authentication mode is set to Local Authentication rather than Windows integrated security or Active Directory
-
Verify presence of default system accountCheck the user accounts configured in Tableau Server or Wonderware Intelligence for a default system account that was present at installation and cannot be easily modifiedAffected if A hardcoded default system account exists and remains active with its original default credentials
-
Confirm local authentication is enabledReview the Tableau Server security or authentication configuration to confirm that local user authentication (not Windows/AD) is currently active and accepting loginsAffected if Local authentication mode is enabled and the default account is accessible for login attempts
You are affected if you have any vulnerable version installed (Tableau 7.0 through 10.1.3 or Wonderware Intelligence 2014 or earlier) AND the system is configured to use local authentication mode instead of Windows integrated security or Active Directory.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedMigrate Tableau Server to use Windows integrated security (Active Directory) for authentication, which disables the vulnerable local authentication pathway. If AD is unavailable, locate and apply the undocumented procedure to change the default system account credentials.
Tableau 10.1.4 or later / Wonderware Intelligence 2014R3 or later
- 1. Verify current Tableau Desktop or Server version by navigating to Help > About Tableau (Desktop) or checking Server status page (Server)
- 2. If using local authentication mode, plan to upgrade to Tableau version 10.1.4 or later (first fixed release after affected 10.1.3)
- 3. If upgrading is not immediately possible, enable Windows integrated security (Active Directory) authentication instead of local authentication to mitigate the vulnerability
- 4. For Wonderware Intelligence, upgrade to version 2014R3 or later (if available)
- 5. After upgrade or reconfiguration, verify the default system account no longer exists or has been changed from default credentials
- 6. Document the authentication method configuration for audit purposes
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2017-5178 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2017-5178 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data