Details of VAR-201811-0092

ID

VAR-201811-0092

CVE

CVE-2018-17922

TITLE

Circontrol CirCarLife Vulnerabilities related to certificate and password management

Trust: 0.8

sources: JVNDB: JVNDB-2018-011780

DESCRIPTION

Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication. Circontrol CirCarLife Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Circontrol CirCarLife is prone to the following multiple security vulnerabilities: 1. An authentication-bypass vulnerability 2. An information-disclosure vulnerability An attacker can exploit these issues to bypass the authentication mechanism and perform unauthorized actions, or to obtain sensitive information. Versions prior to CirCarLife 4.3.1 are vulnerable. CIRCONTROL CirCarLife is a parking lot automation management system developed by Spain CIRCONTROL company

Trust: 1.98

sources: NVD: CVE-2018-17922 // JVNDB: JVNDB-2018-011780 // BID: 105816 // VULHUB: VHN-128430

AFFECTED PRODUCTS

vendor:	circontrol	model:	circarlife	scope:	lt	version:	4.3.1	Trust: 1.0
vendor:	circontrol s a	model:	circarlife	scope:	lt	version:	4.3.1	Trust: 0.8
vendor:	circontrol	model:	circarlife	scope:	eq	version:	4.3	Trust: 0.6
vendor:	circontrol	model:	circarlife	scope:	eq	version:	-	Trust: 0.6
vendor:	circontrol	model:	circarlife	scope:	eq	version:	0	Trust: 0.3
vendor:	circontrol	model:	circarlife	scope:	ne	version:	4.3.1	Trust: 0.3

sources: BID: 105816 // JVNDB: JVNDB-2018-011780 // CNNVD: CNNVD-201811-023 // NVD: CVE-2018-17922

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-17922
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-17922
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201811-023
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-128430
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-17922
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-128430
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-17922
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-128430 // JVNDB: JVNDB-2018-011780 // CNNVD: CNNVD-201811-023 // NVD: CVE-2018-17922

PROBLEMTYPE DATA

problemtype:	CWE-532	Trust: 1.1
problemtype:	CWE-522	Trust: 1.0
problemtype:	CWE-255	Trust: 0.9

sources: VULHUB: VHN-128430 // JVNDB: JVNDB-2018-011780 // NVD: CVE-2018-17922

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201811-023

TYPE

log information leak

Trust: 0.6

sources: CNNVD: CNNVD-201811-023

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-011780

PATCH

title:	Top Page	url:	https://circontrol.com/	Trust: 0.8
title:	CIRCONTROL CirCarLife Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86569	Trust: 0.6

sources: JVNDB: JVNDB-2018-011780 // CNNVD: CNNVD-201811-023

EXTERNAL IDS

db:	NVD	id:	CVE-2018-17922	Trust: 2.8
db:	ICS CERT	id:	ICSA-18-305-03	Trust: 2.8
db:	BID	id:	105816	Trust: 2.0
db:	JVNDB	id:	JVNDB-2018-011780	Trust: 0.8
db:	CNNVD	id:	CNNVD-201811-023	Trust: 0.7
db:	VULHUB	id:	VHN-128430	Trust: 0.1

sources: VULHUB: VHN-128430 // BID: 105816 // JVNDB: JVNDB-2018-011780 // CNNVD: CNNVD-201811-023 // NVD: CVE-2018-17922

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-18-305-03	Trust: 2.8
url:	http://www.securityfocus.com/bid/105816	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17922	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-17922	Trust: 0.8
url:	https://circontrol.com/intelligent-charging-solutions/	Trust: 0.3

sources: VULHUB: VHN-128430 // BID: 105816 // JVNDB: JVNDB-2018-011780 // CNNVD: CNNVD-201811-023 // NVD: CVE-2018-17922

CREDITS

Ankit Anubhav of NewSky Security, M. Can Kurnaz Senior Consultant at KPMG Netherlands, Alim Solmaz Security Consultant at Atos, Michael John Chief Information Security Officer at WePower Network, and Gyorgy Miru Security Researcher at Verint.

Trust: 0.3

sources: BID: 105816

SOURCES

db:	VULHUB	id:	VHN-128430
db:	BID	id:	105816
db:	JVNDB	id:	JVNDB-2018-011780
db:	CNNVD	id:	CNNVD-201811-023
db:	NVD	id:	CVE-2018-17922

LAST UPDATE DATE

2024-11-23T21:52:40.144000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-128430	date:	2019-10-09T00:00:00
db:	BID	id:	105816	date:	2018-11-01T00:00:00
db:	JVNDB	id:	JVNDB-2018-011780	date:	2019-01-23T00:00:00
db:	CNNVD	id:	CNNVD-201811-023	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-17922	date:	2024-11-21T03:55:12.820

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-128430	date:	2018-11-02T00:00:00
db:	BID	id:	105816	date:	2018-11-01T00:00:00
db:	JVNDB	id:	JVNDB-2018-011780	date:	2019-01-23T00:00:00
db:	CNNVD	id:	CNNVD-201811-023	date:	2018-11-02T00:00:00
db:	NVD	id:	CVE-2018-17922	date:	2018-11-02T15:29:00.637