Sign-up

ID

VAR-201903-1013


CVE

CVE-2017-9626


TITLE

Marel Food Processing Systems Pluto Platform access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-014417

DESCRIPTION

Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This update will restrict remote access by implementing SSH authentication. Marel is a supplier of advanced equipment, systems and services in the meat processing industry. A number of Marel unauthorized access vulnerabilities allow an attacker to exploit a vulnerability to access a system using the Pluto platform

Trust: 2.34

sources: NVD: CVE-2017-9626 // JVNDB: JVNDB-2017-014417 // CNVD: CNVD-2017-22832 // IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9 // CNVD: CNVD-2017-22832

AFFECTED PRODUCTS

vendor:marelmodel:pluto1203scope:eqversion:1.0

Trust: 1.0

vendor:marelmodel:pluto2scope:eqversion:1.0.0

Trust: 1.0

vendor:marelmodel:pluto1203scope: - version: -

Trust: 0.8

vendor:marelmodel:pluto2scope: - version: -

Trust: 0.8

vendor:marelmodel:graders using pluto platformscope: - version: -

Trust: 0.6

vendor:marelmodel:portioning machines using pluto platformscope: - version: -

Trust: 0.6

vendor:marelmodel:flowline systems using pluto platformscope: - version: -

Trust: 0.6

vendor:marelmodel:packing systems using pluto platformscope: - version: -

Trust: 0.6

vendor:marelmodel:sensorx machines using pluto platformscope: - version: -

Trust: 0.6

vendor:marelmodel:target batchers using pluto platformscope: - version: -

Trust: 0.6

vendor:marelmodel:speedbatchers using pluto platformscope: - version: -

Trust: 0.6

vendor:pluto1203model: - scope:eqversion:1.0

Trust: 0.2

vendor:pluto2model: - scope:eqversion:1.0.0

Trust: 0.2

sources: IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9 // CNVD: CNVD-2017-22832 // JVNDB: JVNDB-2017-014417 // NVD: CVE-2017-9626

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9626
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-9626
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2017-22832
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201903-1092
value: CRITICAL

Trust: 0.6

IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9
value: CRITICAL

Trust: 0.2

nvd@nist.gov: CVE-2017-9626
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-22832
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-9626
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9 // CNVD: CNVD-2017-22832 // JVNDB: JVNDB-2017-014417 // CNNVD: CNNVD-201903-1092 // NVD: CVE-2017-9626

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.8

problemtype:CWE-732

Trust: 1.0

sources: JVNDB: JVNDB-2017-014417 // NVD: CVE-2017-9626

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201903-1092

TYPE

Access control error

Trust: 0.8

sources: IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9 // CNNVD: CNNVD-201903-1092

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014417

PATCH
title:Top Pageurl:https://marel.com/
Trust: 0.8
title:Food Processing Systems Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90507
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-014417 // 
            
            
            
            CNNVD: CNNVD-201903-1092

EXTERNAL IDS
db:NVDid:CVE-2017-9626
Trust: 3.2
db:ICS CERTid:ICSA-17-094-02B
Trust: 2.4
db:CNVDid:CNVD-2017-22832
Trust: 0.8
db:CNNVDid:CNNVD-201903-1092
Trust: 0.8
db:JVNDBid:JVNDB-2017-014417
Trust: 0.8
db:ICS CERTid:ICSA-17-094-02A
Trust: 0.6
db:IVDid:102248AF-4C91-4F5E-8572-D64FC6FC06E9
Trust: 0.2
sources:
            
            
            IVD: 102248af-4c91-4f5e-8572-d64fc6fc06e9 // 
            
            
            
            CNVD: CNVD-2017-22832 // 
            
            
            
            JVNDB: JVNDB-2017-014417 // 
            
            
            
            CNNVD: CNNVD-201903-1092 // 
            
            
            
            NVD: CVE-2017-9626

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-094-02b
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2017-9626
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9626
Trust: 0.8
url:https://ics-cert.us-cert.gov/advisories/icsa-17-094-02a
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-22832 // 
            
            
            
            JVNDB: JVNDB-2017-014417 // 
            
            
            
            CNNVD: CNNVD-201903-1092 // 
            
            
            
            NVD: CVE-2017-9626

SOURCES
db:IVDid:102248af-4c91-4f5e-8572-d64fc6fc06e9
db:CNVDid:CNVD-2017-22832
db:JVNDBid:JVNDB-2017-014417
db:CNNVDid:CNNVD-201903-1092
db:NVDid:CVE-2017-9626

LAST UPDATE DATE
2024-11-23T21:37:34.996000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-22832date:2017-08-25T00:00:00
db:JVNDBid:JVNDB-2017-014417date:2019-05-09T00:00:00
db:CNNVDid:CNNVD-201903-1092date:2019-10-08T00:00:00
db:NVDid:CVE-2017-9626date:2024-11-21T03:36:32.600

SOURCES RELEASE DATE
db:IVDid:102248af-4c91-4f5e-8572-d64fc6fc06e9date:2017-08-25T00:00:00
db:CNVDid:CNVD-2017-22832date:2017-08-25T00:00:00
db:JVNDBid:JVNDB-2017-014417date:2019-05-09T00:00:00
db:CNNVDid:CNNVD-201903-1092date:2019-03-27T00:00:00
db:NVDid:CVE-2017-9626date:2019-03-27T20:29:03.083