Sign-up

ID

VAR-201401-0139


CVE

CVE-2013-6030


TITLE

Emerson Avocent MergePoint Unity 2016 KVM Switch Unknown remote directory traversal vulnerability

Trust: 0.8

sources: IVD: 445fc886-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-00632

DESCRIPTION

Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.16473 allows remote attackers to read arbitrary files via unspecified vectors, as demonstrated by reading the /etc/passwd file. CWE-23: Relative Path Traversal http://cwe.mitre.org/data/definitions/23.htmlThe product is /etc/passwd Information such as may be obtained. As a result, the product may be accessed with administrator privileges. Avocent MergePoint Unity 2016 KVM is a new generation of managed switches from Emerson. A remote attacker can exploit this issue to obtain sensitive information that could aid in further attacks. An attacker can use directory traversal to download critical files such as /etc/passwd to obtain the credentials for the device. Author: ====== Shady.liu@dbappsecurity.com.cn Description: ====== A remote unauthenticated attacker can download the configuration files of the device and use the obtained administrator credentials to access the interface. The attacker may then modify the settings of the device with unrestricted access. Abstract: ====== http://www.securityfocus.com/bid/65105 http://osvdb.org/show/osvdb/102408 http://www.kb.cert.org/vuls/id/168751 Exploit: ====== DBAppSecurity Co.Ltd. ----------------------------------------------------------- Email:Shady.liu@dbappsecurity.com.cn ----------------------------------------------------------

Trust: 3.51

sources: NVD: CVE-2013-6030 // CERT/CC: VU#168751 // JVNDB: JVNDB-2014-001236 // CNVD: CNVD-2014-00632 // BID: 65105 // IVD: 445fc886-2352-11e6-abef-000c29c66e3d // VULHUB: VHN-66032 // PACKETSTORM: 124951

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: 445fc886-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-00632

AFFECTED PRODUCTS

vendor:emersonmodel:network power avocent mergepoint unity 2016scope:eqversion:1.9.16473

Trust: 1.6

vendor:emerson network powermodel: - scope: - version: -

Trust: 0.8

vendor:emersonmodel:avocent mergepoint unityscope: - version: -

Trust: 0.8

vendor:emersonmodel:avocent mergepoint unityscope:lteversion:version 1.9.16473

Trust: 0.8

vendor:emersonmodel:network power avocent mergepoint unity kvmscope:eqversion:20161.9.16473

Trust: 0.6

vendor:network power avocent mergepoint unity 2016model: - scope:eqversion:1.9.16473

Trust: 0.4

sources: IVD: 445fc886-2352-11e6-abef-000c29c66e3d // CERT/CC: VU#168751 // CNVD: CNVD-2014-00632 // JVNDB: JVNDB-2014-001236 // CNNVD: CNNVD-201401-506 // NVD: CVE-2013-6030

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2013-6030
value: MEDIUM

Trust: 1.6

nvd@nist.gov: CVE-2013-6030
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2014-00632
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201401-506
value: MEDIUM

Trust: 0.6

IVD: 445fc886-2352-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-66032
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-6030
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2013-6030
severity: MEDIUM
baseScore: 4.0
vectorString: NONE
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2014-00632
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 445fc886-2352-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-66032
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 445fc886-2352-11e6-abef-000c29c66e3d // CERT/CC: VU#168751 // CNVD: CNVD-2014-00632 // VULHUB: VHN-66032 // JVNDB: JVNDB-2014-001236 // CNNVD: CNNVD-201401-506 // NVD: CVE-2013-6030

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

problemtype:CWE-23

Trust: 0.8

problemtype:CWE-Other

Trust: 0.8

sources: CERT/CC: VU#168751 // VULHUB: VHN-66032 // JVNDB: JVNDB-2014-001236 // NVD: CVE-2013-6030

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201401-506

TYPE

Path traversal

Trust: 0.8

sources: IVD: 445fc886-2352-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201401-506

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-001236

EXPLOIT AVAILABILITY
sources:
            
            
            CERT/CC: VU#168751 // 
            
            
            
            VULHUB: VHN-66032

PATCH
title:Previous Releasesurl:http://www.avocent.com/Support_Firmware/MergePoint_Unity/MergePoint_Unity_Switch_-_Previous_Releases.aspx
Trust: 0.8
title:MergePoint Unity Firmwareurl:http://www.avocent.com/Support_Firmware/MergePoint_Unity/MergePoint_Unity_Switch.aspx
Trust: 0.8
title:Emerson Avocent MergePoint Unity 2016 KVM Switch Unknown Remote Directory Traversal Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/43041
Trust: 0.6
title:FL0620-AVO-1.14.0.19936url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=48413
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-00632 // 
            
            
            
            JVNDB: JVNDB-2014-001236 // 
            
            
            
            CNNVD: CNNVD-201401-506

EXTERNAL IDS
db:NVDid:CVE-2013-6030
Trust: 3.7
db:CERT/CCid:VU#168751
Trust: 3.4
db:BIDid:65105
Trust: 2.1
db:CNNVDid:CNNVD-201401-506
Trust: 0.9
db:CNVDid:CNVD-2014-00632
Trust: 0.8
db:JVNid:JVNVU95235811
Trust: 0.8
db:JVNDBid:JVNDB-2014-001236
Trust: 0.8
db:OSVDBid:102408
Trust: 0.7
db:IVDid:445FC886-2352-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:124951
Trust: 0.2
db:VULHUBid:VHN-66032
Trust: 0.1
sources:
            
            
            IVD: 445fc886-2352-11e6-abef-000c29c66e3d // 
            
            
            
            CERT/CC: VU#168751 // 
            
            
            
            CNVD: CNVD-2014-00632 // 
            
            
            
            VULHUB: VHN-66032 // 
            
            
            
            BID: 65105 // 
            
            
            
            JVNDB: JVNDB-2014-001236 // 
            
            
            
            PACKETSTORM: 124951 // 
            
            
            
            CNNVD: CNNVD-201401-506 // 
            
            
            
            NVD: CVE-2013-6030

REFERENCES
url:http://www.kb.cert.org/vuls/id/168751
Trust: 2.6
url:http://www.securityfocus.com/bid/65105
Trust: 1.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-6030
Trust: 1.4
url:http://www.emersonnetworkpower.com/en-us/products/infrastructuremanagement/digitalkvmappliances/pages/avocentmergepointunityappliances.aspx
Trust: 0.9
url:http://www.avocent.com/support_firmware/mergepoint_unity/mergepoint_unity_switch.aspx
Trust: 0.9
url: http://www.avocent.com/support_firmware/mergepoint_unity/mergepoint_unity_switch_-_previous_releases.aspx
Trust: 0.9
url:http://cwe.mitre.org/data/definitions/23.html
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-6030
Trust: 0.8
url:http://jvn.jp/vu/jvnvu95235811/index.html
Trust: 0.8
url:http://osvdb.com/show/osvdb/102408
Trust: 0.6
url:http://osvdb.org/show/osvdb/102408
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-6030
Trust: 0.1
sources:
            
            
            CERT/CC: VU#168751 // 
            
            
            
            CNVD: CNVD-2014-00632 // 
            
            
            
            VULHUB: VHN-66032 // 
            
            
            
            JVNDB: JVNDB-2014-001236 // 
            
            
            
            PACKETSTORM: 124951 // 
            
            
            
            CNNVD: CNNVD-201401-506 // 
            
            
            
            NVD: CVE-2013-6030

CREDITS
Shady Liu
Trust: 0.4
sources:
            
            
            BID: 65105 // 
            
            
            
            PACKETSTORM: 124951

SOURCES
db:IVDid:445fc886-2352-11e6-abef-000c29c66e3d
db:CERT/CCid:VU#168751
db:CNVDid:CNVD-2014-00632
db:VULHUBid:VHN-66032
db:BIDid:65105
db:JVNDBid:JVNDB-2014-001236
db:PACKETSTORMid:124951
db:CNNVDid:CNNVD-201401-506
db:NVDid:CVE-2013-6030

LAST UPDATE DATE
2025-04-11T22:48:24.401000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#168751date:2014-02-07T00:00:00
db:CNVDid:CNVD-2014-00632date:2014-01-26T00:00:00
db:VULHUBid:VHN-66032date:2016-12-31T00:00:00
db:BIDid:65105date:2014-01-28T00:33:00
db:JVNDBid:JVNDB-2014-001236date:2014-05-07T00:00:00
db:CNNVDid:CNNVD-201401-506date:2014-01-26T00:00:00
db:NVDid:CVE-2013-6030date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:445fc886-2352-11e6-abef-000c29c66e3ddate:2014-01-26T00:00:00
db:CERT/CCid:VU#168751date:2014-01-23T00:00:00
db:CNVDid:CNVD-2014-00632date:2014-01-26T00:00:00
db:VULHUBid:VHN-66032date:2014-01-24T00:00:00
db:BIDid:65105date:2014-01-23T00:00:00
db:JVNDBid:JVNDB-2014-001236date:2014-01-27T00:00:00
db:PACKETSTORMid:124951date:2014-01-27T02:22:22
db:CNNVDid:CNNVD-201401-506date:2014-01-26T00:00:00
db:NVDid:CVE-2013-6030date:2014-01-24T04:38:09.620