Details of VAR-201705-3543

ID

VAR-201705-3543

CVE

CVE-2017-6051

TITLE

BLF-Tech LLC VisualView HMI Native code execution vulnerability

Trust: 0.8

sources: IVD: 860a990a-68f3-49ee-a184-de930173ccb7 // CNVD: CNVD-2017-06901

DESCRIPTION

An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code. BLF-Tech LLC VisualView HMI Contains a vulnerability related to uncontrolled search path elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. BLF-Tech LLC VisualView HMI is a human-machine interface interactive program from BLF-Tech LLC. BLF-Tech LLC VisualView HMI has a security vulnerability that allows local attackers to exploit arbitrary requests, execute arbitrary code, and increase privileges. VisualView HMI 9.9.14.0 and prior versions are vulnerable

Trust: 2.61

sources: NVD: CVE-2017-6051 // JVNDB: JVNDB-2017-003969 // CNVD: CNVD-2017-06901 // BID: 98031 // IVD: 860a990a-68f3-49ee-a184-de930173ccb7

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 860a990a-68f3-49ee-a184-de930173ccb7 // CNVD: CNVD-2017-06901

AFFECTED PRODUCTS

vendor:	blftech	model:	visualview hmi	scope:	lte	version:	9.9.14.0	Trust: 1.0
vendor:	blf tech	model:	visualview hmi	scope:	lte	version:	9.9.14.0	Trust: 0.8
vendor:	blf tech	model:	llc visualview hmi	scope:	lte	version:	<=9.9.14.0	Trust: 0.6
vendor:	blftech	model:	visualview hmi	scope:	eq	version:	9.9.14.0	Trust: 0.6
vendor:	blf tech	model:	llc visualview hmi	scope:	eq	version:	9.9.14.0	Trust: 0.3
vendor:	blf tech	model:	llc visualview hmi	scope:	ne	version:	10.2.15.0	Trust: 0.3
vendor:	visualview hmi	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 860a990a-68f3-49ee-a184-de930173ccb7 // CNVD: CNVD-2017-06901 // BID: 98031 // JVNDB: JVNDB-2017-003969 // CNNVD: CNNVD-201704-1503 // NVD: CVE-2017-6051

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-6051
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-6051
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-06901
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201704-1503
value:	HIGH
Trust: 0.6
IVD:	860a990a-68f3-49ee-a184-de930173ccb7
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2017-6051
severity:	MEDIUM
baseScore:	5.1
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	4.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-06901
severity:	HIGH
baseScore:	7.6
vectorString:	AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	860a990a-68f3-49ee-a184-de930173ccb7
severity:	HIGH
baseScore:	7.6
vectorString:	AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2017-6051
baseSeverity:	HIGH
baseScore:	7.0
vectorString:	CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.0
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: IVD: 860a990a-68f3-49ee-a184-de930173ccb7 // CNVD: CNVD-2017-06901 // JVNDB: JVNDB-2017-003969 // CNNVD: CNNVD-201704-1503 // NVD: CVE-2017-6051

PROBLEMTYPE DATA

problemtype:

CWE-427

Trust: 1.8

sources: JVNDB: JVNDB-2017-003969 // NVD: CVE-2017-6051

THREAT TYPE

local

Trust: 0.9

sources: BID: 98031 // CNNVD: CNNVD-201704-1503

TYPE

Code problem

Trust: 0.8

sources: IVD: 860a990a-68f3-49ee-a184-de930173ccb7 // CNNVD: CNNVD-201704-1503

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-003969

PATCH

title:	BLF-Tech LLC Patch for VisualView HMI Native Code Execution Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/93906	Trust: 0.6
title:	BLF-Tech LLC VisualView HMI Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=69696	Trust: 0.6

sources: CNVD: CNVD-2017-06901 // CNNVD: CNNVD-201704-1503

EXTERNAL IDS

db:	NVD	id:	CVE-2017-6051	Trust: 3.5
db:	ICS CERT	id:	ICSA-17-115-01	Trust: 3.3
db:	BID	id:	98031	Trust: 2.5
db:	CNVD	id:	CNVD-2017-06901	Trust: 0.8
db:	CNNVD	id:	CNNVD-201704-1503	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-003969	Trust: 0.8
db:	IVD	id:	860A990A-68F3-49EE-A184-DE930173CCB7	Trust: 0.2

sources: IVD: 860a990a-68f3-49ee-a184-de930173ccb7 // CNVD: CNVD-2017-06901 // BID: 98031 // JVNDB: JVNDB-2017-003969 // CNNVD: CNNVD-201704-1503 // NVD: CVE-2017-6051

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-17-115-01	Trust: 3.3
url:	http://www.securityfocus.com/bid/98031	Trust: 2.2
url:	https://nvd.nist.gov/vuln/detail/cve-2017-6051	Trust: 1.4
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6051	Trust: 0.8
url:	http://www.hmisys.com/downloads/visualviewtrialinstaller.exe (link is external)	Trust: 0.3

sources: CNVD: CNVD-2017-06901 // BID: 98031 // JVNDB: JVNDB-2017-003969 // CNNVD: CNNVD-201704-1503 // NVD: CVE-2017-6051

CREDITS

Karn Ganeshen

Trust: 0.9

sources: BID: 98031 // CNNVD: CNNVD-201704-1503

SOURCES

db:	IVD	id:	860a990a-68f3-49ee-a184-de930173ccb7
db:	CNVD	id:	CNVD-2017-06901
db:	BID	id:	98031
db:	JVNDB	id:	JVNDB-2017-003969
db:	CNNVD	id:	CNNVD-201704-1503
db:	NVD	id:	CVE-2017-6051

LAST UPDATE DATE

2025-04-20T23:36:54.498000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-06901	date:	2017-05-18T00:00:00
db:	BID	id:	98031	date:	2017-05-02T04:09:00
db:	JVNDB	id:	JVNDB-2017-003969	date:	2017-06-13T00:00:00
db:	CNNVD	id:	CNNVD-201704-1503	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-6051	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	IVD	id:	860a990a-68f3-49ee-a184-de930173ccb7	date:	2017-05-18T00:00:00
db:	CNVD	id:	CNVD-2017-06901	date:	2017-05-18T00:00:00
db:	BID	id:	98031	date:	2017-04-25T00:00:00
db:	JVNDB	id:	JVNDB-2017-003969	date:	2017-06-13T00:00:00
db:	CNNVD	id:	CNNVD-201704-1503	date:	2017-04-28T00:00:00
db:	NVD	id:	CVE-2017-6051	date:	2017-05-08T17:29:00.157