Sign-up

ID

VAR-201812-1208


TITLE

Command injection vulnerability in NA300 PLC

Trust: 0.6

sources: CNVD: CNVD-2018-26204

DESCRIPTION

NA300 PLC is a medium-sized programmable controller. Command injection vulnerability exists in NA300 PLC. The vulnerability stems from the inability of the ehtdbg program in the system to properly handle input parameters. An attacker can bypass the check by constructing parameters, inject commands, and gain server permissions. , Get server permissions

Trust: 0.72

sources: CNVD: CNVD-2018-26204 // IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1 // CNVD: CNVD-2018-26204

AFFECTED PRODUCTS

vendor:nanda auto jiangsumodel:na300 plcscope: - version: -

Trust: 0.6

vendor:nanda auto jiangsumodel:na300 plcscope:eqversion:*

Trust: 0.2

sources: IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1 // CNVD: CNVD-2018-26204

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2018-26204
value: HIGH

Trust: 0.6

IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1
value: HIGH

Trust: 0.2

CNVD: CNVD-2018-26204
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1 // CNVD: CNVD-2018-26204

TYPE

Command injection

Trust: 0.2

sources: IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1

PATCH

title:Command injection vulnerability in NA300PLCurl:https://www.cnvd.org.cn/patchinfo/show/146133

Trust: 0.6

sources: CNVD: CNVD-2018-26204

EXTERNAL IDS

db:CNVDid:CNVD-2018-26204

Trust: 0.8

db:IVDid:7D83BB9E-463F-11E9-8AEC-000C29342CB1

Trust: 0.2

sources: IVD: 7d83bb9e-463f-11e9-8aec-000c29342cb1 // CNVD: CNVD-2018-26204

SOURCES

db:IVDid:7d83bb9e-463f-11e9-8aec-000c29342cb1
db:CNVDid:CNVD-2018-26204

LAST UPDATE DATE

2022-05-17T01:59:55.598000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2018-26204date:2019-01-10T00:00:00

SOURCES RELEASE DATE

db:IVDid:7d83bb9e-463f-11e9-8aec-000c29342cb1date:2018-12-21T00:00:00
db:CNVDid:CNVD-2018-26204date:2019-01-16T00:00:00