Details of VAR-201812-1203

ID

VAR-201812-1203

TITLE

NA300 PLC has unauthorized operation vulnerability (CNVD-2018-26208)

Trust: 0.6

sources: CNVD: CNVD-2018-26208

DESCRIPTION

NA300 PLC is a medium-sized programmable controller. NA300 PLC has an unauthorized operation vulnerability. Attackers can use the vulnerability to remotely tamper with the system's inputs and outputs, variable values, etc

Trust: 0.72

sources: CNVD: CNVD-2018-26208 // IVD: 7d839490-463f-11e9-8b00-000c29342cb1

IOT TAXONOMY

category:	['ICS', 'Network device']	sub_category:	-	Trust: 0.6
category:	['ICS']	sub_category:	-	Trust: 0.2

sources: IVD: 7d839490-463f-11e9-8b00-000c29342cb1 // CNVD: CNVD-2018-26208

AFFECTED PRODUCTS

vendor:	nanda auto jiangsu	model:	na300 plc	scope:	-	version:	-	Trust: 0.6
vendor:	nanda auto jiangsu	model:	na300 plc	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 7d839490-463f-11e9-8b00-000c29342cb1 // CNVD: CNVD-2018-26208

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2018-26208
value:	LOW
Trust: 0.6
IVD:	7d839490-463f-11e9-8b00-000c29342cb1
value:	LOW
Trust: 0.2

CNVD:	CNVD-2018-26208
severity:	LOW
baseScore:	2.1
vectorString:	AV:N/AC:H/AU:S/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	7d839490-463f-11e9-8b00-000c29342cb1
severity:	LOW
baseScore:	2.1
vectorString:	AV:N/AC:H/AU:S/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 7d839490-463f-11e9-8b00-000c29342cb1 // CNVD: CNVD-2018-26208

TYPE

Access verification error

Trust: 0.2

sources: IVD: 7d839490-463f-11e9-8b00-000c29342cb1

PATCH

title:

Industrial control device vulnerability exists in NA300PLC's tamperable DIDO vulnerability

url:

https://www.cnvd.org.cn/patchinfo/show/146135

Trust: 0.6

sources: CNVD: CNVD-2018-26208

EXTERNAL IDS

db:	CNVD	id:	CNVD-2018-26208	Trust: 0.8
db:	IVD	id:	7D839490-463F-11E9-8B00-000C29342CB1	Trust: 0.2

sources: IVD: 7d839490-463f-11e9-8b00-000c29342cb1 // CNVD: CNVD-2018-26208

SOURCES

db:	IVD	id:	7d839490-463f-11e9-8b00-000c29342cb1
db:	CNVD	id:	CNVD-2018-26208

LAST UPDATE DATE

2022-05-17T02:08:55.999000+00:00

SOURCES UPDATE DATE

db:

CNVD

id:

CNVD-2018-26208

date:

2019-01-10T00:00:00

SOURCES RELEASE DATE

db:	IVD	id:	7d839490-463f-11e9-8b00-000c29342cb1	date:	2018-12-21T00:00:00
db:	CNVD	id:	CNVD-2018-26208	date:	2019-01-16T00:00:00