Sign-up

ID

VAR-201602-0020


CVE

CVE-2016-0862


TITLE

GE Industrial Solutions UPS SNMP/Web Vulnerability to retrieve important plain text account information in adapter device firmware

Trust: 0.8

sources: JVNDB: JVNDB-2016-001557

DESCRIPTION

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information via unspecified vectors. The GE SNMP / Web Interface adapter is a Web server used by General Electric Company to display the current information of the uninterruptible power supply. SNMP/Web Interface is prone to a command-injection vulnerability and an information-disclosure vulnerability. Exploiting these issues could allow an attacker to gain access to potentially sensitive information and execute arbitrary commands in the context of the affected device. Versions prior to SNMP/Web Interface 4.8 are vulnerable

Trust: 2.52

sources: NVD: CVE-2016-0862 // JVNDB: JVNDB-2016-001557 // CNVD: CNVD-2016-00993 // BID: 82407 // VULHUB: VHN-88372

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-00993

AFFECTED PRODUCTS

vendor:gemodel:snmp\/web adapterscope:lteversion:4.7

Trust: 1.0

vendor:general electricmodel:ups snmp/web interface adapter 1024746scope: - version: -

Trust: 0.8

vendor:general electricmodel:ups snmp/web interface adapter 1024747scope: - version: -

Trust: 0.8

vendor:general electricmodel:ups snmp/web interface adapter 1024748scope: - version: -

Trust: 0.8

vendor:general electricmodel:ups snmp/web interface adapter 1024921scope: - version: -

Trust: 0.8

vendor:general electricmodel:ups snmp/web interface adapterscope:ltversion:4.8

Trust: 0.8

vendor:generalmodel:electric industrial solutions ups snmp/web adapterscope:ltversion:4.8

Trust: 0.6

vendor:gemodel:snmp web adapterscope:eqversion:4.7

Trust: 0.6

vendor:gemodel:snmp\/web adapterscope:eqversion:4.7

Trust: 0.6

sources: CNVD: CNVD-2016-00993 // JVNDB: JVNDB-2016-001557 // CNNVD: CNNVD-201602-128 // NVD: CVE-2016-0862

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-0862
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-0862
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2016-00993
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201602-128
value: MEDIUM

Trust: 0.6

VULHUB: VHN-88372
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-0862
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-00993
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-88372
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-0862
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.0

sources: CNVD: CNVD-2016-00993 // VULHUB: VHN-88372 // JVNDB: JVNDB-2016-001557 // CNNVD: CNNVD-201602-128 // NVD: CVE-2016-0862

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-88372 // JVNDB: JVNDB-2016-001557 // NVD: CVE-2016-0862

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201602-128

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201602-128

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-001557

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-88372

PATCH
title:GEIS16-01url:http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf
Trust: 0.8
title:Patch for GE SNMP / Web Interface adapter Information Disclosure Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/71373
Trust: 0.6
title:General Electric SNMP/Web Interface adapter Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60080
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-00993 // 
            
            
            
            JVNDB: JVNDB-2016-001557 // 
            
            
            
            CNNVD: CNNVD-201602-128

EXTERNAL IDS
db:NVDid:CVE-2016-0862
Trust: 3.4
db:ICS CERTid:ICSA-16-033-02
Trust: 3.4
db:EXPLOIT-DBid:39408
Trust: 1.1
db:PACKETSTORMid:135586
Trust: 1.1
db:JVNDBid:JVNDB-2016-001557
Trust: 0.8
db:CNNVDid:CNNVD-201602-128
Trust: 0.7
db:CNVDid:CNVD-2016-00993
Trust: 0.6
db:BIDid:82407
Trust: 0.3
db:VULHUBid:VHN-88372
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-00993 // 
            
            
            
            VULHUB: VHN-88372 // 
            
            
            
            BID: 82407 // 
            
            
            
            JVNDB: JVNDB-2016-001557 // 
            
            
            
            CNNVD: CNNVD-201602-128 // 
            
            
            
            NVD: CVE-2016-0862

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-16-033-02
Trust: 3.4
url:http://apps.geindustrial.com/publibrary/checkout/application%20and%20technical%7cgeis_snmp%7cpdf&filename=geis_snmp.pdf
Trust: 1.6
url:https://www.exploit-db.com/exploits/39408/
Trust: 1.1
url:http://seclists.org/fulldisclosure/2016/feb/21
Trust: 1.1
url:http://packetstormsecurity.com/files/135586/ge-industrial-solutions-ups-snmp-adapter-command-injection.html
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-0862
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-0862
Trust: 0.8
url:http://www.ge.com/
Trust: 0.3
url:http://www.gegridsolutions.com/products/manuals/powerquality/snmp_box_new.pdf
Trust: 0.3
url:http://apps.geindustrial.com/publibrary/checkout/application%20and%20technical%7cgeis_snmp%7cpdf&filename=geis_snmp.pdf
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-00993 // 
            
            
            
            VULHUB: VHN-88372 // 
            
            
            
            BID: 82407 // 
            
            
            
            JVNDB: JVNDB-2016-001557 // 
            
            
            
            CNNVD: CNNVD-201602-128 // 
            
            
            
            NVD: CVE-2016-0862

CREDITS
Karn Ganeshen
Trust: 0.3
sources:
            
            
            BID: 82407

SOURCES
db:CNVDid:CNVD-2016-00993
db:VULHUBid:VHN-88372
db:BIDid:82407
db:JVNDBid:JVNDB-2016-001557
db:CNNVDid:CNNVD-201602-128
db:NVDid:CVE-2016-0862

LAST UPDATE DATE
2025-04-13T23:03:16.787000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-00993date:2016-02-16T00:00:00
db:VULHUBid:VHN-88372date:2018-10-17T00:00:00
db:BIDid:82407date:2016-07-05T21:21:00
db:JVNDBid:JVNDB-2016-001557date:2016-03-03T00:00:00
db:CNNVDid:CNNVD-201602-128date:2016-02-15T00:00:00
db:NVDid:CVE-2016-0862date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-00993date:2016-02-16T00:00:00
db:VULHUBid:VHN-88372date:2016-02-05T00:00:00
db:BIDid:82407date:2016-02-02T00:00:00
db:JVNDBid:JVNDB-2016-001557date:2016-03-03T00:00:00
db:CNNVDid:CNNVD-201602-128date:2016-02-04T00:00:00
db:NVDid:CVE-2016-0862date:2016-02-05T11:59:01.173