Sign-up

ID

VAR-201208-0449


CVE

CVE-2012-4577


TITLE

Korenix Jetport Vulnerabilities that can gain management access in firmware used by Microsoft and other products

Trust: 0.8

sources: JVNDB: JVNDB-2012-003799

DESCRIPTION

The Linux firmware image on (1) Korenix Jetport 5600 series serial-device servers and (2) ORing Industrial DIN-Rail serial-device servers has a hardcoded password of "password" for the root account, which allows remote attackers to obtain administrative access via an SSH session. The Korenix JetPort Series is an intelligent RS-232 or RS-/422/485 serial to Ethernet device networking server. ORing Industrial DIN-Rail serial-device servers are also similar to such devices. Korenix Jetport 5600 series products are prone to a remote authentication-bypass vulnerability. Successful exploits will result in the complete compromise of the affected device. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: JetPort 5600 Hardcoded Credentials Security Issue SECUNIA ADVISORY ID: SA51083 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/51083/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=51083 RELEASE DATE: 2012-10-24 DISCUSS ADVISORY: http://secunia.com/advisories/51083/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/51083/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=51083 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A security issue has been reported in JetPort 5600, which can be exploited by malicious people to compromise a vulnerable device. The security issue is reported in versions prior to 2.01. SOLUTION: Update to version 2.01. PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Reid Wightman, Digital Bond. ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-297-02.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.52

sources: NVD: CVE-2012-4577 // JVNDB: JVNDB-2012-003799 // CNVD: CNVD-2012-4382 // BID: 55196 // PACKETSTORM: 117644

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2012-4382

AFFECTED PRODUCTS

vendor:korenixmodel:jetportscope:eqversion:5601

Trust: 2.4

vendor:korenixmodel:jetportscope:eqversion:5601f

Trust: 2.4

vendor:korenixmodel:jetportscope:eqversion:5604

Trust: 2.4

vendor:korenixmodel:jetportscope:eqversion:5604i

Trust: 2.4

vendor:korenixmodel:jetport series serial-device serversscope:eqversion:5600

Trust: 0.6

vendor:oringmodel:industrial corp. industrial din-rail serial-device serversscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2012-4382 // JVNDB: JVNDB-2012-003799 // CNNVD: CNNVD-201208-363 // NVD: CVE-2012-4577

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-4577
value: HIGH

Trust: 1.0

NVD: CVE-2012-4577
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201208-363
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2012-4577
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2012-003799 // CNNVD: CNNVD-201208-363 // NVD: CVE-2012-4577

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.8

sources: JVNDB: JVNDB-2012-003799 // NVD: CVE-2012-4577

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201208-363

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201208-363

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-003799

PATCH
title:Top Pageurl:http://www.korenix.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-003799

EXTERNAL IDS
db:NVDid:CVE-2012-4577
Trust: 3.3
db:ICS CERTid:ICSA-12-297-02
Trust: 1.9
db:ICS CERTid:ICSA-12-263-02
Trust: 1.8
db:BIDid:55196
Trust: 1.3
db:JVNDBid:JVNDB-2012-003799
Trust: 0.8
db:CNVDid:CNVD-2012-4382
Trust: 0.6
db:NSFOCUSid:47135
Trust: 0.6
db:CNNVDid:CNNVD-201208-363
Trust: 0.6
db:SECUNIAid:51083
Trust: 0.2
db:PACKETSTORMid:117644
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-4382 // 
            
            
            
            BID: 55196 // 
            
            
            
            JVNDB: JVNDB-2012-003799 // 
            
            
            
            PACKETSTORM: 117644 // 
            
            
            
            CNNVD: CNNVD-201208-363 // 
            
            
            
            NVD: CVE-2012-4577

REFERENCES
url:http://ics-cert.us-cert.gov/advisories/icsa-12-297-02
Trust: 1.8
url:http://ics-cert.us-cert.gov/advisories/icsa-12-263-02
Trust: 1.8
url:http://www.digitalbond.com/2012/06/13/korenix-and-oring-insecurity/
Trust: 1.4
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/77992
Trust: 1.0
url:http://www.digitalbond.com/2012/06/13/korenix-and-oring-insecurity
Trust: 1.0
url:http://www.securityfocus.com/bid/55196
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4577
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4577
Trust: 0.8
url:http://www.nsfocus.net/vulndb/47135
Trust: 0.6
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://secunia.com/advisories/51083/#comments
Trust: 0.1
url:http://secunia.com/advisories/51083/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=51083
Trust: 0.1
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-297-02.pdf
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-4382 // 
            
            
            
            JVNDB: JVNDB-2012-003799 // 
            
            
            
            PACKETSTORM: 117644 // 
            
            
            
            CNNVD: CNNVD-201208-363 // 
            
            
            
            NVD: CVE-2012-4577

CREDITS
Reid Wightman
Trust: 0.9
sources:
            
            
            BID: 55196 // 
            
            
            
            CNNVD: CNNVD-201208-363

SOURCES
db:CNVDid:CNVD-2012-4382
db:BIDid:55196
db:JVNDBid:JVNDB-2012-003799
db:PACKETSTORMid:117644
db:CNNVDid:CNNVD-201208-363
db:NVDid:CVE-2012-4577

LAST UPDATE DATE
2025-04-11T23:16:40.610000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-4382date:2012-08-23T00:00:00
db:BIDid:55196date:2012-10-23T23:40:00
db:JVNDBid:JVNDB-2012-003799date:2013-06-26T00:00:00
db:CNNVDid:CNNVD-201208-363date:2020-07-14T00:00:00
db:NVDid:CVE-2012-4577date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2012-4382date:2012-08-23T00:00:00
db:BIDid:55196date:2012-08-23T00:00:00
db:JVNDBid:JVNDB-2012-003799date:2012-08-23T00:00:00
db:PACKETSTORMid:117644date:2012-10-25T06:24:20
db:CNNVDid:CNNVD-201208-363date:2012-08-22T00:00:00
db:NVDid:CVE-2012-4577date:2012-08-21T18:55:01.327