Details of VAR-201501-0401

ID

VAR-201501-0401

CVE

CVE-2014-9195

TITLE

Phoenix Contact ProConOs and MultiProg Vulnerabilities in arbitrary command execution

Trust: 0.8

sources: JVNDB: JVNDB-2014-007726

DESCRIPTION

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic. Phoenix Contact ProConOs and MultiProg are applications that run processes to control and manage IEC 61131 logic. Phoenix Contact ProConOs and MultiProg are prone to an authentication-bypass vulnerability. Attackers can exploit this issue to bypass authentication mechanism and gain unauthorized access. http://drupal.org/node/207891

Trust: 2.61

sources: NVD: CVE-2014-9195 // JVNDB: JVNDB-2014-007726 // CNVD: CNVD-2015-00410 // BID: 72063 // IVD: a90acc0a-2351-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: a90acc0a-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-00410

AFFECTED PRODUCTS

vendor:	phoenixcontact	model:	multiprog	scope:	eq	version:	5.0	Trust: 1.6
vendor:	phoenixcontact	model:	proconos eclr	scope:	eq	version:	*	Trust: 1.0
vendor:	proconos eclr	model:	-	scope:	eq	version:	*	Trust: 0.8
vendor:	phoenix contact	model:	multiprog	scope:	eq	version:	-	Trust: 0.8
vendor:	phoenix contact	model:	proconos	scope:	eq	version:	-	Trust: 0.8
vendor:	multiprog	model:	-	scope:	eq	version:	5.0	Trust: 0.6
vendor:	phoenix	model:	contact phoenix contact proconos and multiprog	scope:	-	version:	-	Trust: 0.6
vendor:	pheonixcontact	model:	proconos eclr	scope:	eq	version:	visual_studio	Trust: 0.6
vendor:	pheonixcontact	model:	proconos eclr	scope:	-	version:	-	Trust: 0.6
vendor:	pheonixcontact	model:	proconos eclr	scope:	eq	version:	single_chip	Trust: 0.6
vendor:	pheonixcontact	model:	multiprog	scope:	eq	version:	5.0	Trust: 0.6
vendor:	pheonixcontact	model:	proconos eclr	scope:	eq	version:	softplc	Trust: 0.6
vendor:	phoenix	model:	contact proconos	scope:	eq	version:	0	Trust: 0.3
vendor:	phoenix	model:	contact multiprog	scope:	eq	version:	0	Trust: 0.3

sources: IVD: a90acc0a-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-00410 // BID: 72063 // JVNDB: JVNDB-2014-007726 // NVD: CVE-2014-9195 // CNNVD: CNNVD-201501-318

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2014-9195
value:	HIGH
Trust: 1.8
CNVD:	CNVD-2015-00410
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201501-318
value:	HIGH
Trust: 0.6
IVD:	a90acc0a-2351-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2

NVD:
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2014-9195
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2015-00410
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	a90acc0a-2351-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: a90acc0a-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-00410 // JVNDB: JVNDB-2014-007726 // NVD: CVE-2014-9195 // CNNVD: CNNVD-201501-318

PROBLEMTYPE DATA

problemtype:

CWE-255

Trust: 1.8

sources: JVNDB: JVNDB-2014-007726 // NVD: CVE-2014-9195

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201501-318

TYPE

Trust management

Trust: 0.8

sources: IVD: a90acc0a-2351-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201501-318

CONFIGURATIONS

sources: NVD: CVE-2014-9195

PATCH

title:

Top Page

url:

https://www.phoenixcontact.com/online/portal/de?1dmy&urile=wcm%3apath%3a/dede/web/home

Trust: 0.8

sources: JVNDB: JVNDB-2014-007726

EXTERNAL IDS

db:	NVD	id:	CVE-2014-9195	Trust: 3.5
db:	ICS CERT	id:	ICSA-15-013-03	Trust: 3.3
db:	BID	id:	72063	Trust: 1.5
db:	EXPLOIT-DB	id:	37066	Trust: 1.0
db:	CNVD	id:	CNVD-2015-00410	Trust: 0.8
db:	CNNVD	id:	CNNVD-201501-318	Trust: 0.8
db:	JVNDB	id:	JVNDB-2014-007726	Trust: 0.8
db:	BID	id:	72064	Trust: 0.6
db:	IVD	id:	A90ACC0A-2351-11E6-ABEF-000C29C66E3D	Trust: 0.2

sources: IVD: a90acc0a-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-00410 // BID: 72063 // JVNDB: JVNDB-2014-007726 // NVD: CVE-2014-9195 // CNNVD: CNNVD-201501-318

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-15-013-03	Trust: 3.3
url:	https://www.exploit-db.com/exploits/37066/	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9195	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9195	Trust: 0.8
url:	http://www.securityfocus.com/bid/72064	Trust: 0.6
url:	http://www.securityfocus.com/bid/72063	Trust: 0.6
url:	https://www.phoenixcontact.com/online/portal/pc	Trust: 0.3

sources: CNVD: CNVD-2015-00410 // BID: 72063 // JVNDB: JVNDB-2014-007726 // NVD: CVE-2014-9195 // CNNVD: CNNVD-201501-318

CREDITS

Reid Wightman of Digital Bond.

Trust: 0.9

sources: BID: 72063 // CNNVD: CNNVD-201501-318

SOURCES

db:	IVD	id:	a90acc0a-2351-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2015-00410
db:	BID	id:	72063
db:	JVNDB	id:	JVNDB-2014-007726
db:	NVD	id:	CVE-2014-9195
db:	CNNVD	id:	CNNVD-201501-318

LAST UPDATE DATE

2023-12-18T12:07:39.721000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2015-00410	date:	2015-01-19T00:00:00
db:	BID	id:	72063	date:	2015-01-13T00:00:00
db:	JVNDB	id:	JVNDB-2014-007726	date:	2015-01-23T00:00:00
db:	NVD	id:	CVE-2014-9195	date:	2018-11-29T14:43:56.267
db:	CNNVD	id:	CNNVD-201501-318	date:	2015-01-19T00:00:00

SOURCES RELEASE DATE

db:	IVD	id:	a90acc0a-2351-11e6-abef-000c29c66e3d	date:	2015-01-19T00:00:00
db:	CNVD	id:	CNVD-2015-00410	date:	2015-01-19T00:00:00
db:	BID	id:	72063	date:	2015-01-13T00:00:00
db:	JVNDB	id:	JVNDB-2014-007726	date:	2015-01-23T00:00:00
db:	NVD	id:	CVE-2014-9195	date:	2015-01-17T02:59:05.630
db:	CNNVD	id:	CNNVD-201501-318	date:	2015-01-16T00:00:00