Details of VAR-201710-0718

ID

VAR-201710-0718

CVE

CVE-2017-15567

TITLE

MorphoSmart 1300 Series access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-009609

DESCRIPTION

The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK. IDEMIA ( Old Morpho) MorphoSmart 1300 series ( alias MSO 1300 series ) Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. IDEMIA (formerly known as Morpho) MorphoSmart 1300 Series (also known as MSO 1300 Series) devices is a fingerprint identification device produced by French company IDEMIA (formerly known as Morpho). The certificate import component is one of the certificate import components. There is a security vulnerability in the certificate import module in IDEMIA MSO 1300 Series devices. A local attacker can exploit this vulnerability to obtain a command shell, thereby gaining privileges

Trust: 1.71

sources: NVD: CVE-2017-15567 // JVNDB: JVNDB-2017-009609 // VULHUB: VHN-106402

AFFECTED PRODUCTS

vendor:	idemia	model:	mso 1300	scope:	eq	version:	-	Trust: 1.0
vendor:	morpho	model:	morphosmart 1300 series	scope:	-	version:	-	Trust: 0.8
vendor:	morpho	model:	mso 1300	scope:	eq	version:	-	Trust: 0.6

sources: JVNDB: JVNDB-2017-009609 // CNNVD: CNNVD-201710-1076 // NVD: CVE-2017-15567

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-15567
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-15567
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201710-1076
value:	HIGH
Trust: 0.6
VULHUB:	VHN-106402
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-15567
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-106402
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-15567
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-106402 // JVNDB: JVNDB-2017-009609 // CNNVD: CNNVD-201710-1076 // NVD: CVE-2017-15567

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-284	Trust: 0.9

sources: VULHUB: VHN-106402 // JVNDB: JVNDB-2017-009609 // NVD: CVE-2017-15567

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201710-1076

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201710-1076

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009609

PATCH

title:

MorphoSmart 1300 Series

url:

https://www.morpho.com/en/biometric-terminals/desktop-devices/fingerprint-devices/morphosmart-1300-series

Trust: 0.8

sources: JVNDB: JVNDB-2017-009609

EXTERNAL IDS

db:	NVD	id:	CVE-2017-15567	Trust: 2.5
db:	JVNDB	id:	JVNDB-2017-009609	Trust: 0.8
db:	CNNVD	id:	CNNVD-201710-1076	Trust: 0.7
db:	VULHUB	id:	VHN-106402	Trust: 0.1

sources: VULHUB: VHN-106402 // JVNDB: JVNDB-2017-009609 // CNNVD: CNNVD-201710-1076 // NVD: CVE-2017-15567

REFERENCES

url:	https://gist.github.com/shiham101/4c49ece8ecac7c3c02ecbc6942aeca80	Trust: 2.5
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-15567	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-15567	Trust: 0.8

sources: VULHUB: VHN-106402 // JVNDB: JVNDB-2017-009609 // CNNVD: CNNVD-201710-1076 // NVD: CVE-2017-15567

SOURCES

db:	VULHUB	id:	VHN-106402
db:	JVNDB	id:	JVNDB-2017-009609
db:	CNNVD	id:	CNNVD-201710-1076
db:	NVD	id:	CVE-2017-15567

LAST UPDATE DATE

2025-04-20T23:15:53.352000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-106402	date:	2019-10-03T00:00:00
db:	JVNDB	id:	JVNDB-2017-009609	date:	2017-11-16T00:00:00
db:	CNNVD	id:	CNNVD-201710-1076	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2017-15567	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-106402	date:	2017-10-23T00:00:00
db:	JVNDB	id:	JVNDB-2017-009609	date:	2017-11-16T00:00:00
db:	CNNVD	id:	CNNVD-201710-1076	date:	2017-10-31T00:00:00
db:	NVD	id:	CVE-2017-15567	date:	2017-10-23T08:29:00.680