Sign-up

ID

VAR-201710-1319


CVE

CVE-2017-9625


TITLE

Envitech Ltd EnviDAS Ultimate Authentication Bypass Vulnerability

Trust: 0.8

sources: IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7 // CNVD: CNVD-2017-29974

DESCRIPTION

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view information and modify settings or execute code remotely. Envidas Ultimate is Envitech Ltd's intelligent, versatile, multi-site continuous emissions monitoring and data acquisition system. Envitech EnviDAS Ultimate is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass authentication mechanism and perform unauthorized actions. This may lead to further attacks

Trust: 2.61

sources: NVD: CVE-2017-9625 // JVNDB: JVNDB-2017-009513 // CNVD: CNVD-2017-29974 // BID: 101249 // IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7 // CNVD: CNVD-2017-29974

AFFECTED PRODUCTS

vendor:envitechmodel:envidas ultimatescope:lteversion:1.0.0.4

Trust: 1.0

vendor:envitechmodel:envidas ultimatescope:ltversion:1.0.0.5

Trust: 0.8

vendor:envitechmodel:envidas ultimatescope:ltversion:v1.0.0.5

Trust: 0.6

vendor:envitechmodel:envidas ultimatescope:eqversion:1.0.0.4

Trust: 0.6

vendor:envitechmodel:ltd envidas ultimatescope:eqversion:1.0.0.4

Trust: 0.3

vendor:envitechmodel:ltd envidas ultimatescope:neversion:1.0.0.5

Trust: 0.3

vendor:envidas ultimatemodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7 // CNVD: CNVD-2017-29974 // BID: 101249 // JVNDB: JVNDB-2017-009513 // CNNVD: CNNVD-201710-577 // NVD: CVE-2017-9625

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9625
value: HIGH

Trust: 1.0

NVD: CVE-2017-9625
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-29974
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201710-577
value: HIGH

Trust: 0.6

IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2017-9625
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-29974
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:L/AU:N/C:C/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:L/AU:N/C:C/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-9625
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 4.2
version: 3.0

Trust: 1.8

sources: IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7 // CNVD: CNVD-2017-29974 // JVNDB: JVNDB-2017-009513 // CNNVD: CNNVD-201710-577 // NVD: CVE-2017-9625

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.8

sources: JVNDB: JVNDB-2017-009513 // NVD: CVE-2017-9625

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201710-577

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201710-577

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-009513

PATCH
title:Top Pageurl:http://www.envitech.co.il/
Trust: 0.8
title:Envitech Ltd EnviDAS Ultimate authentication bypass vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/103555
Trust: 0.6
title:Envitech EnviDAS Ultimate Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=100113
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-29974 // 
            
            
            
            JVNDB: JVNDB-2017-009513 // 
            
            
            
            CNNVD: CNNVD-201710-577

EXTERNAL IDS
db:NVDid:CVE-2017-9625
Trust: 3.5
db:ICS CERTid:ICSA-17-285-03
Trust: 3.3
db:BIDid:101249
Trust: 1.9
db:CNVDid:CNVD-2017-29974
Trust: 0.8
db:CNNVDid:CNNVD-201710-577
Trust: 0.8
db:JVNDBid:JVNDB-2017-009513
Trust: 0.8
db:IVDid:3A32BA24-6E0F-4236-9CC1-A3BF2668DDE7
Trust: 0.2
sources:
            
            
            IVD: 3a32ba24-6e0f-4236-9cc1-a3bf2668dde7 // 
            
            
            
            CNVD: CNVD-2017-29974 // 
            
            
            
            BID: 101249 // 
            
            
            
            JVNDB: JVNDB-2017-009513 // 
            
            
            
            CNNVD: CNNVD-201710-577 // 
            
            
            
            NVD: CVE-2017-9625

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-285-03
Trust: 3.3
url:http://www.securityfocus.com/bid/101249
Trust: 1.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9625
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-9625
Trust: 0.8
url:http://envitech.co.il/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-29974 // 
            
            
            
            BID: 101249 // 
            
            
            
            JVNDB: JVNDB-2017-009513 // 
            
            
            
            CNNVD: CNNVD-201710-577 // 
            
            
            
            NVD: CVE-2017-9625

CREDITS
Can Demirel and Deniz ?evik of Biznet Bilisim
Trust: 0.3
sources:
            
            
            BID: 101249

SOURCES
db:IVDid:3a32ba24-6e0f-4236-9cc1-a3bf2668dde7
db:CNVDid:CNVD-2017-29974
db:BIDid:101249
db:JVNDBid:JVNDB-2017-009513
db:CNNVDid:CNNVD-201710-577
db:NVDid:CVE-2017-9625

LAST UPDATE DATE
2025-04-20T23:19:45.435000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-29974date:2017-10-13T00:00:00
db:BIDid:101249date:2017-10-12T00:00:00
db:JVNDBid:JVNDB-2017-009513date:2017-11-14T00:00:00
db:CNNVDid:CNNVD-201710-577date:2019-10-17T00:00:00
db:NVDid:CVE-2017-9625date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:3a32ba24-6e0f-4236-9cc1-a3bf2668dde7date:2017-10-13T00:00:00
db:CNVDid:CNVD-2017-29974date:2017-10-13T00:00:00
db:BIDid:101249date:2017-10-12T00:00:00
db:JVNDBid:JVNDB-2017-009513date:2017-11-14T00:00:00
db:CNNVDid:CNNVD-201710-577date:2017-10-17T00:00:00
db:NVDid:CVE-2017-9625date:2017-10-17T22:29:00.463