Sign-up

ID

VAR-201710-0793


CVE

CVE-2017-13996


TITLE

LOYTEC LVIS-3ME Path traversal vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-008626 // CNNVD: CNNVD-201709-868

DESCRIPTION

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code. LOYTEC LVIS-3ME Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: : 1. A directory-traversal vulnerability 2. An insufficient-entropy vulnerability 3. A cross-site scripting vulnerability 4. Versions prior to LVIS-3ME 6.2.0 are vulnerable. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany. There is a directory traversal vulnerability in LOYTEC LVIS-3ME versions before 6.2.0. The vulnerability stems from the fact that the program does not restrict non-administrator users from accessing important files

Trust: 2.07

sources: NVD: CVE-2017-13996 // JVNDB: JVNDB-2017-008626 // BID: 100847 // VULHUB: VHN-104674 // VULMON: CVE-2017-13996

AFFECTED PRODUCTS

vendor:loytecmodel:lvis-3mescope:lteversion:6.1.1

Trust: 1.0

vendor:loytecmodel:lvis-3mescope:ltversion:6.2.0

Trust: 0.8

vendor:loytecmodel:lvis-3mescope:eqversion:6.1.1

Trust: 0.6

vendor:loytecmodel:lvis-3mescope:eqversion:0

Trust: 0.3

vendor:loytecmodel:lvis-3mescope:neversion:6.2

Trust: 0.3

sources: BID: 100847 // JVNDB: JVNDB-2017-008626 // CNNVD: CNNVD-201709-868 // NVD: CVE-2017-13996

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-13996
value: HIGH

Trust: 1.0

NVD: CVE-2017-13996
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201709-868
value: HIGH

Trust: 0.6

VULHUB: VHN-104674
value: MEDIUM

Trust: 0.1

VULMON: CVE-2017-13996
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-13996
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-104674
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-13996
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-104674 // VULMON: CVE-2017-13996 // JVNDB: JVNDB-2017-008626 // CNNVD: CNNVD-201709-868 // NVD: CVE-2017-13996

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

problemtype:CWE-23

Trust: 1.0

sources: VULHUB: VHN-104674 // JVNDB: JVNDB-2017-008626 // NVD: CVE-2017-13996

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-868

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201709-868

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-008626

PATCH
title:トップページurl:https://www.loytec.com/jp/
Trust: 0.8
title:LOYTEC LVIS-3ME Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74973
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-008626 // 
            
            
            
            CNNVD: CNNVD-201709-868

EXTERNAL IDS
db:ICS CERTid:ICSA-17-257-01
Trust: 2.9
db:NVDid:CVE-2017-13996
Trust: 2.9
db:BIDid:100847
Trust: 2.1
db:JVNDBid:JVNDB-2017-008626
Trust: 0.8
db:CNNVDid:CNNVD-201709-868
Trust: 0.7
db:VULHUBid:VHN-104674
Trust: 0.1
db:VULMONid:CVE-2017-13996
Trust: 0.1
sources:
            
            
            VULHUB: VHN-104674 // 
            
            
            
            VULMON: CVE-2017-13996 // 
            
            
            
            BID: 100847 // 
            
            
            
            JVNDB: JVNDB-2017-008626 // 
            
            
            
            CNNVD: CNNVD-201709-868 // 
            
            
            
            NVD: CVE-2017-13996

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-257-01
Trust: 2.9
url:http://www.securityfocus.com/bid/100847
Trust: 1.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13996
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-13996
Trust: 0.8
url:https://www.loytec.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/22.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-104674 // 
            
            
            
            VULMON: CVE-2017-13996 // 
            
            
            
            BID: 100847 // 
            
            
            
            JVNDB: JVNDB-2017-008626 // 
            
            
            
            CNNVD: CNNVD-201709-868 // 
            
            
            
            NVD: CVE-2017-13996

CREDITS
Davy Douhine of RandoriSec
Trust: 0.9
sources:
            
            
            BID: 100847 // 
            
            
            
            CNNVD: CNNVD-201709-868

SOURCES
db:VULHUBid:VHN-104674
db:VULMONid:CVE-2017-13996
db:BIDid:100847
db:JVNDBid:JVNDB-2017-008626
db:CNNVDid:CNNVD-201709-868
db:NVDid:CVE-2017-13996

LAST UPDATE DATE
2025-04-20T23:22:10.026000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-104674date:2019-10-09T00:00:00
db:VULMONid:CVE-2017-13996date:2019-10-09T00:00:00
db:BIDid:100847date:2017-09-14T00:00:00
db:JVNDBid:JVNDB-2017-008626date:2017-10-25T00:00:00
db:CNNVDid:CNNVD-201709-868date:2019-10-17T00:00:00
db:NVDid:CVE-2017-13996date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-104674date:2017-10-05T00:00:00
db:VULMONid:CVE-2017-13996date:2017-10-05T00:00:00
db:BIDid:100847date:2017-09-14T00:00:00
db:JVNDBid:JVNDB-2017-008626date:2017-10-25T00:00:00
db:CNNVDid:CNNVD-201709-868date:2017-09-21T00:00:00
db:NVDid:CVE-2017-13996date:2017-10-05T21:29:00.350