Sign-up

ID

VAR-201708-1416


CVE

CVE-2017-9630


TITLE

plural PDQ Manufacturing Authentication vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-007166

DESCRIPTION

An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The web server does not properly verify that provided authentication information is correct. plural PDQ Manufacturing The product contains authentication vulnerabilities.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PDQ Manufacturing LaserWash G5 and others are all automotive automatic cleaning equipment from PDQ Manufacturing. Web-server is one of the web servers. An attacker can use this vulnerability to gain access to the system and issue commands that affect the normal operation of the system. An authentication bypass vulnerability 2

Trust: 2.7

sources: NVD: CVE-2017-9630 // JVNDB: JVNDB-2017-007166 // CNVD: CNVD-2017-23006 // BID: 100133 // IVD: 636a6fd1-d79a-40a5-9522-e6e1373e1d08 // VULHUB: VHN-117833

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 636a6fd1-d79a-40a5-9522-e6e1373e1d08 // CNVD: CNVD-2017-23006

AFFECTED PRODUCTS

vendor:pdqincmodel:laserwash autoxpress plusscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:laserjetscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:laserwash g5 sscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:protouch tandemscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:laserwash 360 plusscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:laserwash m5scope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:laserwash 360scope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:protouch iconscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:protouch autoglossscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:laserwash autoxpressscope:eqversion: -

Trust: 1.6

vendor:pdqincmodel:laserwash g5scope:eqversion: -

Trust: 1.0

vendor:pdq manufacturingmodel:laserjetscope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:laserwash 360 plusscope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:laserwash 360scope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:laserwash autoexpress plusscope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:laserwash autoxpressscope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:laserwash g5 s seriesscope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:laserwash g5scope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:laserwash m5scope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:protouch autoglossscope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:protouch iconscope:eqversion: -

Trust: 0.8

vendor:pdq manufacturingmodel:protouch tandemscope:eqversion: -

Trust: 0.8

vendor:pdqmodel:manufacturing laserwash g5scope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing laserwash g5 sscope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing laserwash m5scope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing laserwashscope:eqversion:360

Trust: 0.6

vendor:pdqmodel:manufacturing laserwash plusscope:eqversion:360

Trust: 0.6

vendor:pdqmodel:manufacturing laserwash autoxpressscope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing laserwash autoexpress plusscope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing laserjetscope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing protouch tandemscope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing protouch iconscope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing protouch autoglossscope: - version: -

Trust: 0.6

vendor:pdqmodel:manufacturing inc protouch tandemscope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc protouch iconscope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc protouch autoglossscope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserwash m5scope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserwash g5 sscope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserwash g5scope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserwash autoxpressscope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserwash autoexpress plusscope:eqversion:0

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserwash plusscope:eqversion:3600

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserwashscope:eqversion:3600

Trust: 0.3

vendor:pdqmodel:manufacturing inc laserjetscope:eqversion:0

Trust: 0.3

vendor:laserwash g5model: - scope:eqversion: -

Trust: 0.2

vendor:protouch iconmodel: - scope:eqversion: -

Trust: 0.2

vendor:protouch autoglossmodel: - scope:eqversion: -

Trust: 0.2

vendor:laserwash g5 smodel: - scope:eqversion: -

Trust: 0.2

vendor:laserwash m5model: - scope:eqversion: -

Trust: 0.2

vendor:laserwash 360model: - scope:eqversion: -

Trust: 0.2

vendor:laserwash 360 plusmodel: - scope:eqversion: -

Trust: 0.2

vendor:laserwash autoxpressmodel: - scope:eqversion: -

Trust: 0.2

vendor:laserwash autoxpress plusmodel: - scope:eqversion: -

Trust: 0.2

vendor:laserjetmodel: - scope:eqversion: -

Trust: 0.2

vendor:protouch tandemmodel: - scope:eqversion: -

Trust: 0.2

sources: IVD: 636a6fd1-d79a-40a5-9522-e6e1373e1d08 // CNVD: CNVD-2017-23006 // BID: 100133 // JVNDB: JVNDB-2017-007166 // CNNVD: CNNVD-201708-155 // NVD: CVE-2017-9630

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9630
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-9630
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2017-23006
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201708-155
value: CRITICAL

Trust: 0.6

IVD: 636a6fd1-d79a-40a5-9522-e6e1373e1d08
value: CRITICAL

Trust: 0.2

VULHUB: VHN-117833
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-9630
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-23006
severity: HIGH
baseScore: 9.7
vectorString: AV:N/AC:L/AU:N/C:P/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 9.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 636a6fd1-d79a-40a5-9522-e6e1373e1d08
severity: HIGH
baseScore: 9.7
vectorString: AV:N/AC:L/AU:N/C:P/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 9.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-117833
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-9630
baseSeverity: CRITICAL
baseScore: 9.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.5
version: 3.0

Trust: 1.8

sources: IVD: 636a6fd1-d79a-40a5-9522-e6e1373e1d08 // CNVD: CNVD-2017-23006 // VULHUB: VHN-117833 // JVNDB: JVNDB-2017-007166 // CNNVD: CNNVD-201708-155 // NVD: CVE-2017-9630

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-117833 // JVNDB: JVNDB-2017-007166 // NVD: CVE-2017-9630

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-155

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201708-155

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-007166

PATCH
title:Top Pageurl:https://www.pdqinc.com/
Trust: 0.8
title:Patches for multiple PDQ product permissions to obtain vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/100891
Trust: 0.6
title:Multiple PDQ Product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=72390
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-23006 // 
            
            
            
            JVNDB: JVNDB-2017-007166 // 
            
            
            
            CNNVD: CNNVD-201708-155

EXTERNAL IDS
db:NVDid:CVE-2017-9630
Trust: 3.6
db:ICS CERTid:ICSA-17-208-03
Trust: 3.4
db:CNNVDid:CNNVD-201708-155
Trust: 0.9
db:CNVDid:CNVD-2017-23006
Trust: 0.8
db:JVNDBid:JVNDB-2017-007166
Trust: 0.8
db:BIDid:100133
Trust: 0.3
db:IVDid:636A6FD1-D79A-40A5-9522-E6E1373E1D08
Trust: 0.2
db:VULHUBid:VHN-117833
Trust: 0.1
sources:
            
            
            IVD: 636a6fd1-d79a-40a5-9522-e6e1373e1d08 // 
            
            
            
            CNVD: CNVD-2017-23006 // 
            
            
            
            VULHUB: VHN-117833 // 
            
            
            
            BID: 100133 // 
            
            
            
            JVNDB: JVNDB-2017-007166 // 
            
            
            
            CNNVD: CNNVD-201708-155 // 
            
            
            
            NVD: CVE-2017-9630

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-208-03
Trust: 3.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9630
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-9630
Trust: 0.8
url:http://www.pdqinc.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-23006 // 
            
            
            
            VULHUB: VHN-117833 // 
            
            
            
            BID: 100133 // 
            
            
            
            JVNDB: JVNDB-2017-007166 // 
            
            
            
            CNNVD: CNNVD-201708-155 // 
            
            
            
            NVD: CVE-2017-9630

CREDITS
Billy Rios and Jonathan Butts of WhiteScope and independent security researcher Terry McCorkle.
Trust: 0.3
sources:
            
            
            BID: 100133

SOURCES
db:IVDid:636a6fd1-d79a-40a5-9522-e6e1373e1d08
db:CNVDid:CNVD-2017-23006
db:VULHUBid:VHN-117833
db:BIDid:100133
db:JVNDBid:JVNDB-2017-007166
db:CNNVDid:CNNVD-201708-155
db:NVDid:CVE-2017-9630

LAST UPDATE DATE
2025-04-20T23:32:05.994000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-23006date:2017-08-26T00:00:00
db:VULHUBid:VHN-117833date:2019-10-09T00:00:00
db:BIDid:100133date:2017-07-27T00:00:00
db:JVNDBid:JVNDB-2017-007166date:2017-09-12T00:00:00
db:CNNVDid:CNNVD-201708-155date:2019-10-17T00:00:00
db:NVDid:CVE-2017-9630date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:636a6fd1-d79a-40a5-9522-e6e1373e1d08date:2017-08-26T00:00:00
db:CNVDid:CNVD-2017-23006date:2017-08-26T00:00:00
db:VULHUBid:VHN-117833date:2017-08-07T00:00:00
db:BIDid:100133date:2017-07-27T00:00:00
db:JVNDBid:JVNDB-2017-007166date:2017-09-12T00:00:00
db:CNNVDid:CNNVD-201708-155date:2017-07-27T00:00:00
db:NVDid:CVE-2017-9630date:2017-08-07T08:29:00.370