Details of VAR-201702-0697

ID

VAR-201702-0697

CVE

CVE-2017-5145

TITLE

Carlo Gavazzi VMU-C EM and VMU-C PV Firmware cross-site request forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-001714

DESCRIPTION

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration. CarloGavazziAutomationVMU-CEM and VMU-CPV are control modules in the automation products of Italy's CarloGavazzi Automation. There is a cross-site request forgery vulnerability in CarloGavazziAutomationVMU-CEM and VMU-CPV. A remote attacker exploits a vulnerability to trick a user into parsing by constructing a malicious URL to perform malicious actions in the context of the target user. Exploiting these issues may allow a remote attacker to gain access to the sensitive information, or perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible. An attacker could exploit the vulnerability to perform unauthorized operations. *VMU-C Web-Server solution for photovoltaic applications* VMU-C EM is a data logger system for small to medium projects, VMUC-Y EM is a hardware data aggregator for medium to larger projects and Em2 Server is a software solution for large projects. They are designed to complement the extensive line of Carlo Gavazzi energy meters and current transformers. Weak Credentials Management* -> admin/admin -> Application does not enforce mandatory password change *2. Sensitive Information stored in clear-text* Accounts menu option a shows username and password a passwords shown in clear-text a SMTP server password a user and service passwords are stored in clear-text *3. Access Control flaws* 1. Access control is not enforced correctly 2. Certain application functions can be accessed without any authentication 3. Application stores the Energy / Plant data in a sqlite database - EWPlant.db. Anyone can dump plant database file - without any authentication *4. Reflected + Stored XSS - multiple URLs, parameters - *Not documented in ICS-CERT Advisory Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject arbitrary JavaScript in a specially crafted URL request where the response containing user data is returned to the web browser without being made safe to display. *5. +++++

Trust: 2.88

sources: NVD: CVE-2017-5145 // JVNDB: JVNDB-2017-001714 // CNVD: CNVD-2017-00492 // BID: 95411 // IVD: 699fb07b-5711-4fcb-bc97-0358cd8754c0 // VULHUB: VHN-113348 // VULMON: CVE-2017-5145 // PACKETSTORM: 142045

IOT TAXONOMY

category:	['ICS', 'Network device']	sub_category:	-	Trust: 0.6
category:	['ICS']	sub_category:	-	Trust: 0.2

sources: IVD: 699fb07b-5711-4fcb-bc97-0358cd8754c0 // CNVD: CNVD-2017-00492

AFFECTED PRODUCTS

vendor:	carlosgavazzi	model:	vmu-c pv	scope:	eq	version:	-	Trust: 1.6
vendor:	carlosgavazzi	model:	vmu-c em	scope:	eq	version:	-	Trust: 1.6
vendor:	carlo gavazzi	model:	vmu-c em	scope:	-	version:	-	Trust: 0.8
vendor:	carlo gavazzi	model:	vmu-c em	scope:	lt	version:	a11_u05	Trust: 0.8
vendor:	carlo gavazzi	model:	vmu-c pv	scope:	-	version:	-	Trust: 0.8
vendor:	carlo gavazzi	model:	vmu-c pv	scope:	lt	version:	a17	Trust: 0.8
vendor:	carlo	model:	gavazzi vmu-c em <a11 u05	scope:	-	version:	-	Trust: 0.6
vendor:	carlo	model:	gavazzi vmu-c pv <a17	scope:	-	version:	-	Trust: 0.6
vendor:	carlo	model:	gavazzi vmu-c pv	scope:	eq	version:	0	Trust: 0.3
vendor:	carlo	model:	gavazzi vmu-c em	scope:	eq	version:	0	Trust: 0.3
vendor:	carlo	model:	gavazzi vmu-c pv a17	scope:	ne	version:	-	Trust: 0.3
vendor:	carlo	model:	gavazzi vmu-c em a11 u05	scope:	ne	version:	-	Trust: 0.3
vendor:	vmu c em	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	vmu c pv	model:	-	scope:	eq	version:	-	Trust: 0.2

sources: IVD: 699fb07b-5711-4fcb-bc97-0358cd8754c0 // CNVD: CNVD-2017-00492 // BID: 95411 // JVNDB: JVNDB-2017-001714 // CNNVD: CNNVD-201701-324 // NVD: CVE-2017-5145

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-5145
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2017-5145
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2017-00492
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201701-324
value:	HIGH
Trust: 0.6
IVD:	699fb07b-5711-4fcb-bc97-0358cd8754c0
value:	HIGH
Trust: 0.2
VULHUB:	VHN-113348
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-5145
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-5145
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2017-00492
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	699fb07b-5711-4fcb-bc97-0358cd8754c0
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-113348
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-5145
baseSeverity:	CRITICAL
baseScore:	10.0
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	6.0
version:	3.0
Trust: 1.8

sources: IVD: 699fb07b-5711-4fcb-bc97-0358cd8754c0 // CNVD: CNVD-2017-00492 // VULHUB: VHN-113348 // VULMON: CVE-2017-5145 // JVNDB: JVNDB-2017-001714 // CNNVD: CNNVD-201701-324 // NVD: CVE-2017-5145

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-113348 // JVNDB: JVNDB-2017-001714 // NVD: CVE-2017-5145

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201701-324

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201701-324

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-001714

PATCH

title:	Top Page	url:	http://www.productselection.net/	Trust: 0.8
title:	CarloGavazziAutomationVMU-CEM and VMU-CPV have patches for cross-site request forgery vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/88076	Trust: 0.6
title:	Carlo Gavazzi Automation VMU-C EM and VMU-C PV Fixes for cross-site request forgery vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66988	Trust: 0.6

sources: CNVD: CNVD-2017-00492 // JVNDB: JVNDB-2017-001714 // CNNVD: CNNVD-201701-324

EXTERNAL IDS

db:	NVD	id:	CVE-2017-5145	Trust: 3.8
db:	ICS CERT	id:	ICSA-17-012-03	Trust: 3.6
db:	BID	id:	95411	Trust: 2.1
db:	CNNVD	id:	CNNVD-201701-324	Trust: 0.9
db:	CNVD	id:	CNVD-2017-00492	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-001714	Trust: 0.8
db:	IVD	id:	699FB07B-5711-4FCB-BC97-0358CD8754C0	Trust: 0.2
db:	VULHUB	id:	VHN-113348	Trust: 0.1
db:	VULMON	id:	CVE-2017-5145	Trust: 0.1
db:	PACKETSTORM	id:	142045	Trust: 0.1

sources: IVD: 699fb07b-5711-4fcb-bc97-0358cd8754c0 // CNVD: CNVD-2017-00492 // VULHUB: VHN-113348 // VULMON: CVE-2017-5145 // BID: 95411 // JVNDB: JVNDB-2017-001714 // PACKETSTORM: 142045 // CNNVD: CNNVD-201701-324 // NVD: CVE-2017-5145

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-17-012-03	Trust: 3.7
url:	http://www.securityfocus.com/bid/95411	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5145	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-5145	Trust: 0.8
url:	http://www.securityfocus.com/bid/95411/info	Trust: 0.6
url:	http://www.carlogavazzi.com/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/352.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-5145	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-5144	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-5146	Trust: 0.1

sources: CNVD: CNVD-2017-00492 // VULHUB: VHN-113348 // VULMON: CVE-2017-5145 // BID: 95411 // JVNDB: JVNDB-2017-001714 // PACKETSTORM: 142045 // CNNVD: CNNVD-201701-324 // NVD: CVE-2017-5145

CREDITS

Karn Ganeshen

Trust: 0.4

sources: BID: 95411 // PACKETSTORM: 142045

SOURCES

db:	IVD	id:	699fb07b-5711-4fcb-bc97-0358cd8754c0
db:	CNVD	id:	CNVD-2017-00492
db:	VULHUB	id:	VHN-113348
db:	VULMON	id:	CVE-2017-5145
db:	BID	id:	95411
db:	JVNDB	id:	JVNDB-2017-001714
db:	PACKETSTORM	id:	142045
db:	CNNVD	id:	CNNVD-201701-324
db:	NVD	id:	CVE-2017-5145

LAST UPDATE DATE

2025-04-20T23:20:06.319000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-00492	date:	2017-01-17T00:00:00
db:	VULHUB	id:	VHN-113348	date:	2017-02-24T00:00:00
db:	VULMON	id:	CVE-2017-5145	date:	2017-02-24T00:00:00
db:	BID	id:	95411	date:	2017-01-23T04:05:00
db:	JVNDB	id:	JVNDB-2017-001714	date:	2017-03-14T00:00:00
db:	CNNVD	id:	CNNVD-201701-324	date:	2017-01-13T00:00:00
db:	NVD	id:	CVE-2017-5145	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	IVD	id:	699fb07b-5711-4fcb-bc97-0358cd8754c0	date:	2017-01-17T00:00:00
db:	CNVD	id:	CNVD-2017-00492	date:	2017-01-17T00:00:00
db:	VULHUB	id:	VHN-113348	date:	2017-02-13T00:00:00
db:	VULMON	id:	CVE-2017-5145	date:	2017-02-13T00:00:00
db:	BID	id:	95411	date:	2017-01-12T00:00:00
db:	JVNDB	id:	JVNDB-2017-001714	date:	2017-03-14T00:00:00
db:	PACKETSTORM	id:	142045	date:	2017-04-06T18:22:22
db:	CNNVD	id:	CNNVD-201701-324	date:	2017-01-13T00:00:00
db:	NVD	id:	CVE-2017-5145	date:	2017-02-13T21:59:02.550