Sign-up

ID

VAR-201804-0082


CVE

CVE-2016-8380


TITLE

Phoenix Contact ILC Security Bypass Vulnerability

Trust: 0.8

sources: IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee // CNVD: CNVD-2016-10997

DESCRIPTION

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. Phoenix Contact ProConOs and MultiProg are programmable logic controllers (PLCs) for industrial PCs from the Phoenix Contact group in Germany. Phoenix Contact ILC PLC is prone to multiple authentication-bypass vulnerabilities and an information-disclosure vulnerability. Attackers may exploit these issues to gain unauthorized access to restricted content by bypassing intended security restrictions or to obtain sensitive information that may aid in launching further attacks

Trust: 2.7

sources: NVD: CVE-2016-8380 // JVNDB: JVNDB-2016-009006 // CNVD: CNVD-2016-10997 // BID: 94163 // IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee // VULHUB: VHN-97200

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee // CNVD: CNVD-2016-10997

AFFECTED PRODUCTS

vendor:phoenixcontactmodel:ilc plcsscope:eqversion: -

Trust: 1.6

vendor:phoenix contactmodel:ilc programmable logic controllerscope: - version: -

Trust: 0.8

vendor:phoenixmodel:contact ilc plcscope: - version: -

Trust: 0.6

vendor:phoenixmodel:contact ilc plcscope:eqversion:0

Trust: 0.3

vendor:ilc plcsmodel: - scope:eqversion: -

Trust: 0.2

sources: IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee // CNVD: CNVD-2016-10997 // BID: 94163 // JVNDB: JVNDB-2016-009006 // CNNVD: CNNVD-201611-315 // NVD: CVE-2016-8380

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-8380
value: HIGH

Trust: 1.0

NVD: CVE-2016-8380
value: HIGH

Trust: 0.8

CNVD: CNVD-2016-10997
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201611-315
value: HIGH

Trust: 0.6

IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee
value: HIGH

Trust: 0.2

VULHUB: VHN-97200
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-8380
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-10997
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-97200
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-8380
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 3.4
version: 3.0

Trust: 1.8

sources: IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee // CNVD: CNVD-2016-10997 // VULHUB: VHN-97200 // JVNDB: JVNDB-2016-009006 // CNNVD: CNNVD-201611-315 // NVD: CVE-2016-8380

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

problemtype:CWE-767

Trust: 1.0

sources: VULHUB: VHN-97200 // JVNDB: JVNDB-2016-009006 // NVD: CVE-2016-8380

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201611-315

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201611-315

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-009006

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-97200

PATCH
title:トップページurl:https://www.phoenixcontact.com/online/portal/jp?1dmy&urile=wcm%3apath%3a/jpja/web/home
Trust: 0.8
title:Phoenix Contact ILC Security Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/83812
Trust: 0.6
title:Phoenix Contact ILC PLC Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65683
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-10997 // 
            
            
            
            JVNDB: JVNDB-2016-009006 // 
            
            
            
            CNNVD: CNNVD-201611-315

EXTERNAL IDS
db:NVDid:CVE-2016-8380
Trust: 3.6
db:BIDid:94163
Trust: 2.6
db:EXPLOIT-DBid:45590
Trust: 1.1
db:CNNVDid:CNNVD-201611-315
Trust: 0.9
db:CNVDid:CNVD-2016-10997
Trust: 0.8
db:JVNDBid:JVNDB-2016-009006
Trust: 0.8
db:IVDid:98950ED2-7AEC-4D4D-BB48-4C87EDDBF7EE
Trust: 0.2
db:VULHUBid:VHN-97200
Trust: 0.1
sources:
            
            
            IVD: 98950ed2-7aec-4d4d-bb48-4c87eddbf7ee // 
            
            
            
            CNVD: CNVD-2016-10997 // 
            
            
            
            VULHUB: VHN-97200 // 
            
            
            
            BID: 94163 // 
            
            
            
            JVNDB: JVNDB-2016-009006 // 
            
            
            
            CNNVD: CNNVD-201611-315 // 
            
            
            
            NVD: CVE-2016-8380

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-313-01
Trust: 2.8
url:http://www.securityfocus.com/bid/94163
Trust: 2.3
url:https://www.exploit-db.com/exploits/45590/
Trust: 1.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8380
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2016-8380
Trust: 0.8
url:https://www.phoenixcontact.com/online/portal/pc
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-10997 // 
            
            
            
            VULHUB: VHN-97200 // 
            
            
            
            BID: 94163 // 
            
            
            
            JVNDB: JVNDB-2016-009006 // 
            
            
            
            CNNVD: CNNVD-201611-315 // 
            
            
            
            NVD: CVE-2016-8380

CREDITS
Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg.
Trust: 0.9
sources:
            
            
            BID: 94163 // 
            
            
            
            CNNVD: CNNVD-201611-315

SOURCES
db:IVDid:98950ed2-7aec-4d4d-bb48-4c87eddbf7ee
db:CNVDid:CNVD-2016-10997
db:VULHUBid:VHN-97200
db:BIDid:94163
db:JVNDBid:JVNDB-2016-009006
db:CNNVDid:CNNVD-201611-315
db:NVDid:CVE-2016-8380

LAST UPDATE DATE
2024-11-23T22:17:36.558000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-10997date:2016-11-14T00:00:00
db:VULHUBid:VHN-97200date:2018-10-14T00:00:00
db:BIDid:94163date:2016-11-24T01:08:00
db:JVNDBid:JVNDB-2016-009006date:2018-06-06T00:00:00
db:CNNVDid:CNNVD-201611-315date:2018-12-04T00:00:00
db:NVDid:CVE-2016-8380date:2024-11-21T02:59:15.500

SOURCES RELEASE DATE
db:IVDid:98950ed2-7aec-4d4d-bb48-4c87eddbf7eedate:2016-11-14T00:00:00
db:CNVDid:CNVD-2016-10997date:2016-11-14T00:00:00
db:VULHUBid:VHN-97200date:2018-04-05T00:00:00
db:BIDid:94163date:2016-11-08T00:00:00
db:JVNDBid:JVNDB-2016-009006date:2018-06-06T00:00:00
db:CNNVDid:CNNVD-201611-315date:2016-11-16T00:00:00
db:NVDid:CVE-2016-8380date:2018-04-05T16:29:00.330