Sign-up

ID

VAR-201706-0462


CVE

CVE-2017-6038


TITLE

Belden Hirschmann GECKO Cross-Site Request Forgery Vulnerability

Trust: 0.8

sources: IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b // CNVD: CNVD-2017-12580

DESCRIPTION

A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request. BeldenHirschmannGECKO is a streamlined managed industrial Ethernet switch. The vulnerability stems from a program that failed to adequately verify the request. An attacker could exploit the vulnerability to perform unauthorized operations

Trust: 2.43

sources: NVD: CVE-2017-6038 // JVNDB: JVNDB-2017-005058 // CNVD: CNVD-2017-12580 // IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b // VULHUB: VHN-114241

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b // CNVD: CNVD-2017-12580

AFFECTED PRODUCTS

vendor:belden hirschmannmodel:gecko lite managed switchscope:lteversion:2.0.00

Trust: 1.0

vendor:beldenmodel:gecko lite managed switchscope:lteversion:2.0.00

Trust: 0.8

vendor:beldenmodel:hirschmann gecko lite managed switchscope:lteversion:<=2.0.00

Trust: 0.6

vendor:belden hirschmannmodel:gecko lite managed switchscope:eqversion:2.0.00

Trust: 0.6

vendor:gecko lite managed switchmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b // CNVD: CNVD-2017-12580 // JVNDB: JVNDB-2017-005058 // CNNVD: CNNVD-201707-036 // NVD: CVE-2017-6038

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6038
value: HIGH

Trust: 1.0

NVD: CVE-2017-6038
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-12580
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201707-036
value: HIGH

Trust: 0.6

IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b
value: HIGH

Trust: 0.2

VULHUB: VHN-114241
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-6038
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-12580
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-114241
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-6038
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 4.2
version: 3.0

Trust: 1.8

sources: IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b // CNVD: CNVD-2017-12580 // VULHUB: VHN-114241 // JVNDB: JVNDB-2017-005058 // CNNVD: CNNVD-201707-036 // NVD: CVE-2017-6038

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-114241 // JVNDB: JVNDB-2017-005058 // NVD: CVE-2017-6038

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-036

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201707-036

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-005058

PATCH
title:GECKO 4TXurl:https://www.e-catalog.beldensolutions.com/link/57078-24455-402707-402708/en/conf/0
Trust: 0.8
title:BeldenHirschmannGECKO cross-site request forged vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/97186
Trust: 0.6
title:Belden Hirschmann GECKO Lite Managed Switch Fixes for cross-site request forgery vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71391
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-12580 // 
            
            
            
            JVNDB: JVNDB-2017-005058 // 
            
            
            
            CNNVD: CNNVD-201707-036

EXTERNAL IDS
db:NVDid:CVE-2017-6038
Trust: 3.3
db:ICS CERTid:ICSA-17-026-02A
Trust: 3.1
db:CNNVDid:CNNVD-201707-036
Trust: 0.9
db:CNVDid:CNVD-2017-12580
Trust: 0.8
db:JVNDBid:JVNDB-2017-005058
Trust: 0.8
db:IVDid:E5BAA0EA-998B-4F62-9819-2FFA9E9E9C3B
Trust: 0.2
db:VULHUBid:VHN-114241
Trust: 0.1
sources:
            
            
            IVD: e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b // 
            
            
            
            CNVD: CNVD-2017-12580 // 
            
            
            
            VULHUB: VHN-114241 // 
            
            
            
            JVNDB: JVNDB-2017-005058 // 
            
            
            
            CNNVD: CNNVD-201707-036 // 
            
            
            
            NVD: CVE-2017-6038

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-026-02a
Trust: 3.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6038
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-6038
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2017-12580 // 
            
            
            
            VULHUB: VHN-114241 // 
            
            
            
            JVNDB: JVNDB-2017-005058 // 
            
            
            
            CNNVD: CNNVD-201707-036 // 
            
            
            
            NVD: CVE-2017-6038

SOURCES
db:IVDid:e5baa0ea-998b-4f62-9819-2ffa9e9e9c3b
db:CNVDid:CNVD-2017-12580
db:VULHUBid:VHN-114241
db:JVNDBid:JVNDB-2017-005058
db:CNNVDid:CNNVD-201707-036
db:NVDid:CVE-2017-6038

LAST UPDATE DATE
2025-04-20T23:23:49.162000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-12580date:2017-07-04T00:00:00
db:VULHUBid:VHN-114241date:2019-10-09T00:00:00
db:JVNDBid:JVNDB-2017-005058date:2017-07-13T00:00:00
db:CNNVDid:CNNVD-201707-036date:2019-10-17T00:00:00
db:NVDid:CVE-2017-6038date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:e5baa0ea-998b-4f62-9819-2ffa9e9e9c3bdate:2017-07-04T00:00:00
db:CNVDid:CNVD-2017-12580date:2017-07-04T00:00:00
db:VULHUBid:VHN-114241date:2017-06-30T00:00:00
db:JVNDBid:JVNDB-2017-005058date:2017-07-13T00:00:00
db:CNNVDid:CNNVD-201707-036date:2017-06-29T00:00:00
db:NVDid:CVE-2017-6038date:2017-06-30T03:29:00.500