Sign-up

ID

VAR-201702-0082


CVE

CVE-2016-8378


TITLE

Lynxspring JENEsys BAS Bridge Security Bypass Vulnerability

Trust: 1.4

sources: IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc // CNVD: CNVD-2016-11244 // CNNVD: CNNVD-201611-548

DESCRIPTION

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting credentials. Lynxspring is an American company. BAS Bridge is a web-based SCADA system. BAS server deployment areas include commercial facilities, manufacturing, energy, water and wastewater systems, and more. Lynxspring JENEsys BAS Bridge has a security bypass vulnerability. An attacker exploits a vulnerability to obtain a certificate of authentication, bypassing the verification. A privilege-escalation vulnerability 2. An authentication-bypass vulnerability 3. A security-bypass vulnerability 3. A cross-site request-forgery vulnerability An attackers may exploit these issues to gain unauthorized access to restricted content, bypass intended security restrictions, gain elevated privileges or perform certain unauthorized actions and gain access to the affected application that may aid in launching further attacks

Trust: 2.61

sources: NVD: CVE-2016-8378 // JVNDB: JVNDB-2016-007649 // CNVD: CNVD-2016-11244 // BID: 94344 // IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc // CNVD: CNVD-2016-11244

AFFECTED PRODUCTS

vendor:lynxspringmodel:jenesys bas bridgescope:lteversion:1.1.8

Trust: 1.8

vendor:lynxspringmodel:bas bridgescope:eqversion:1.1.8

Trust: 0.9

vendor:lynxspringmodel:jenesys bas bridgescope:eqversion:1.1.8

Trust: 0.6

vendor:jenesys bas bridgemodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc // CNVD: CNVD-2016-11244 // BID: 94344 // JVNDB: JVNDB-2016-007649 // CNNVD: CNNVD-201611-548 // NVD: CVE-2016-8378

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-8378
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-8378
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2016-11244
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201611-548
value: MEDIUM

Trust: 0.6

IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2016-8378
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-11244
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2016-8378
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc // CNVD: CNVD-2016-11244 // JVNDB: JVNDB-2016-007649 // CNNVD: CNNVD-201611-548 // NVD: CVE-2016-8378

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.8

sources: JVNDB: JVNDB-2016-007649 // NVD: CVE-2016-8378

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201611-548

TYPE

Trust management

Trust: 0.8

sources: IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc // CNNVD: CNNVD-201611-548

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-007649

PATCH
title:Top Pageurl:http://www.lynxspring.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2016-007649

EXTERNAL IDS
db:NVDid:CVE-2016-8378
Trust: 3.5
db:ICS CERTid:ICSA-16-320-01
Trust: 3.3
db:BIDid:94344
Trust: 2.5
db:CNVDid:CNVD-2016-11244
Trust: 0.8
db:CNNVDid:CNNVD-201611-548
Trust: 0.8
db:JVNDBid:JVNDB-2016-007649
Trust: 0.8
db:IVDid:6F6DE983-3195-42D1-AA06-3918A78A1EDC
Trust: 0.2
sources:
            
            
            IVD: 6f6de983-3195-42d1-aa06-3918a78a1edc // 
            
            
            
            CNVD: CNVD-2016-11244 // 
            
            
            
            BID: 94344 // 
            
            
            
            JVNDB: JVNDB-2016-007649 // 
            
            
            
            CNNVD: CNNVD-201611-548 // 
            
            
            
            NVD: CVE-2016-8378

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-16-320-01
Trust: 3.3
url:http://www.securityfocus.com/bid/94344
Trust: 1.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8378
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-8378
Trust: 0.8
url:http://www.lynxspring.com/technology/jenesys
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-11244 // 
            
            
            
            BID: 94344 // 
            
            
            
            JVNDB: JVNDB-2016-007649 // 
            
            
            
            CNNVD: CNNVD-201611-548 // 
            
            
            
            NVD: CVE-2016-8378

CREDITS
Maxim Rupp
Trust: 0.9
sources:
            
            
            BID: 94344 // 
            
            
            
            CNNVD: CNNVD-201611-548

SOURCES
db:IVDid:6f6de983-3195-42d1-aa06-3918a78a1edc
db:CNVDid:CNVD-2016-11244
db:BIDid:94344
db:JVNDBid:JVNDB-2016-007649
db:CNNVDid:CNNVD-201611-548
db:NVDid:CVE-2016-8378

LAST UPDATE DATE
2025-04-20T23:29:45.785000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-11244date:2016-11-17T00:00:00
db:BIDid:94344date:2016-11-24T01:10:00
db:JVNDBid:JVNDB-2016-007649date:2017-03-08T00:00:00
db:CNNVDid:CNNVD-201611-548date:2016-11-25T00:00:00
db:NVDid:CVE-2016-8378date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:6f6de983-3195-42d1-aa06-3918a78a1edcdate:2016-11-17T00:00:00
db:CNVDid:CNVD-2016-11244date:2016-11-17T00:00:00
db:BIDid:94344date:2016-11-15T00:00:00
db:JVNDBid:JVNDB-2016-007649date:2017-03-08T00:00:00
db:CNNVDid:CNNVD-201611-548date:2016-11-25T00:00:00
db:NVDid:CVE-2016-8378date:2017-02-13T21:59:01.393