Sign-up

ID

VAR-201802-0615


CVE

CVE-2017-9968


TITLE

Schneider Electric IGSS Mobile Application validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-012624

DESCRIPTION

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack. Schneider Electric IGSS Mobile The application contains a certificate validation vulnerability.Information may be obtained. An attacker could use this vulnerability to perform a man-in-the-middle attack. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. The following products are affected: IGSS Mobile for Android, version 3.01 and prior. IGSS Mobile for iOS, version 3.01 and prior

Trust: 2.43

sources: NVD: CVE-2017-9968 // JVNDB: JVNDB-2017-012624 // CNVD: CNVD-2018-05674 // BID: 103048

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-05674

AFFECTED PRODUCTS

vendor:schneider electricmodel:igss mobilescope:lteversion:3.01

Trust: 1.8

vendor:schneidermodel:electric igss mobile appscope:lteversion:<=3.01

Trust: 0.6

vendor:schneider electricmodel:igss mobilescope:eqversion:3.01

Trust: 0.6

vendor:schneider electricmodel:igss mobile for iosscope:eqversion:3.01

Trust: 0.3

vendor:schneider electricmodel:igss mobile for androidscope:eqversion:3.01

Trust: 0.3

sources: CNVD: CNVD-2018-05674 // BID: 103048 // JVNDB: JVNDB-2017-012624 // CNNVD: CNNVD-201706-1080 // NVD: CVE-2017-9968

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9968
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-9968
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2018-05674
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201706-1080
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2017-9968
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-05674
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2017-9968
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-05674 // JVNDB: JVNDB-2017-012624 // CNNVD: CNNVD-201706-1080 // NVD: CVE-2017-9968

PROBLEMTYPE DATA

problemtype:CWE-295

Trust: 1.8

sources: JVNDB: JVNDB-2017-012624 // NVD: CVE-2017-9968

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201706-1080

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201706-1080

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-012624

PATCH
title:SEVD-2018-039-02url:https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=9561605997&p_File_Name=SEVD-2018-039-02+IGSS+Mobile.pdf&p_Reference=SEVD-2018-039-02
Trust: 0.8
title:Patch for Schneider Electric IGSS Mobile Security Configuration Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/122059
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-05674 // 
            
            
            
            JVNDB: JVNDB-2017-012624

EXTERNAL IDS
db:NVDid:CVE-2017-9968
Trust: 3.3
db:ICS CERTid:ICSA-18-046-03
Trust: 2.1
db:BIDid:103048
Trust: 1.9
db:SCHNEIDERid:SEVD-2018-039-02
Trust: 1.9
db:JVNDBid:JVNDB-2017-012624
Trust: 0.8
db:CNVDid:CNVD-2018-05674
Trust: 0.6
db:CNNVDid:CNNVD-201706-1080
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-05674 // 
            
            
            
            BID: 103048 // 
            
            
            
            JVNDB: JVNDB-2017-012624 // 
            
            
            
            CNNVD: CNNVD-201706-1080 // 
            
            
            
            NVD: CVE-2017-9968

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-18-046-03
Trust: 2.1
url:https://www.schneider-electric.com/en/download/document/sevd-2018-039-02/
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2017-9968
Trust: 1.4
url:http://www.securityfocus.com/bid/103048
Trust: 1.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9968
Trust: 0.8
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
url:https://download.schneider-electric.com/files?p_endoctype=technical+leaflet&p_file_id=9111551123&p_file_name=sevd-2018-039-02+igss+mobile.pdf&p_reference=sevd-2018-039-02
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-05674 // 
            
            
            
            BID: 103048 // 
            
            
            
            JVNDB: JVNDB-2017-012624 // 
            
            
            
            CNNVD: CNNVD-201706-1080 // 
            
            
            
            NVD: CVE-2017-9968

CREDITS
Alexander Bolshev (IOActive) and Ivan Yushkevich (Embedi)
Trust: 0.3
sources:
            
            
            BID: 103048

SOURCES
db:CNVDid:CNVD-2018-05674
db:BIDid:103048
db:JVNDBid:JVNDB-2017-012624
db:CNNVDid:CNNVD-201706-1080
db:NVDid:CVE-2017-9968

LAST UPDATE DATE
2024-11-23T22:30:30.219000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-05674date:2018-03-20T00:00:00
db:BIDid:103048date:2018-02-15T00:00:00
db:JVNDBid:JVNDB-2017-012624date:2018-03-28T00:00:00
db:CNNVDid:CNNVD-201706-1080date:2018-02-13T00:00:00
db:NVDid:CVE-2017-9968date:2024-11-21T03:37:16.363

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-05674date:2018-03-20T00:00:00
db:BIDid:103048date:2018-02-15T00:00:00
db:JVNDBid:JVNDB-2017-012624date:2018-03-28T00:00:00
db:CNNVDid:CNNVD-201706-1080date:2017-06-27T00:00:00
db:NVDid:CVE-2017-9968date:2018-02-12T23:29:00.357