Details of VAR-202008-0160

ID

VAR-202008-0160

CVE

CVE-2020-14483

TITLE

Tridium Made Niagara Vulnerability that remote connection terminal does not time out

Trust: 0.8

sources: JVNDB: JVNDB-2020-007432

DESCRIPTION

A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to correct. Tridium Provides Niagara Is a building automation system. As a result, threads on the system may hang and a manual reboot is required for recovery. Niagara is a platform used to support the connection of devices and applications. Attackers can use the vulnerability to cause the Niagara thread to hang

Trust: 2.16

sources: NVD: CVE-2020-14483 // JVNDB: JVNDB-2020-007432 // CNVD: CNVD-2020-49618

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-49618

AFFECTED PRODUCTS

vendor:	tridium	model:	niagara	scope:	eq	version:	4.6.96.28	Trust: 1.6
vendor:	tridium	model:	niagara	scope:	eq	version:	4.7.109.20	Trust: 1.6
vendor:	tridium	model:	niagara	scope:	eq	version:	4.7.110.32	Trust: 1.6
vendor:	tridium	model:	niagara	scope:	eq	version:	4.8.0.110	Trust: 1.6
vendor:	tridium	model:	niagara enterprise security	scope:	eq	version:	2.4.31	Trust: 1.6
vendor:	tridium	model:	niagara enterprise security	scope:	eq	version:	2.4.45	Trust: 1.6
vendor:	tridium	model:	niagara enterprise security	scope:	eq	version:	4.8.0.35	Trust: 1.6
vendor:	tridium	model:	niagara	scope:	eq	version:	4.6.96.28、 4.7.109.20、 4.7.110.32、 4.8.0.110	Trust: 0.8
vendor:	tridium	model:	niagara enterprise security	scope:	eq	version:	2.4.31、 2.4.45、 4.8.0.35	Trust: 0.8

sources: CNVD: CNVD-2020-49618 // JVNDB: JVNDB-2020-007432 // NVD: CVE-2020-14483

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-14483
value:	MEDIUM
Trust: 1.0
IPA:	JVNDB-2020-007432
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-49618
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202008-593
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-14483
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
CNVD:	CNVD-2020-49618
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-14483
baseSeverity:	MEDIUM
baseScore:	4.3
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	1.4
version:	3.1
Trust: 1.0
IPA score:	JVNDB-2020-007432
baseSeverity:	MEDIUM
baseScore:	4.3
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-49618 // JVNDB: JVNDB-2020-007432 // CNNVD: CNNVD-202008-593 // NVD: CVE-2020-14483

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-1088	Trust: 1.0

sources: NVD: CVE-2020-14483

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202008-593

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202008-593

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-007432

PATCH

title:	SB 2020-Tridium-2(PDF)	url:	https://www.tridium.com/~/media/tridium/library/documents/sb2020-tridium-2	Trust: 0.8
title:	Patch for Tridium Niagara and Niagara Enterprise Security have unspecified vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/232405	Trust: 0.6
title:	Tridium Niagara and Niagara Enterprise Security Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=126632	Trust: 0.6

sources: CNVD: CNVD-2020-49618 // JVNDB: JVNDB-2020-007432 // CNNVD: CNNVD-202008-593

EXTERNAL IDS

db:	NVD	id:	CVE-2020-14483	Trust: 3.0
db:	ICS CERT	id:	ICSA-20-224-03	Trust: 3.0
db:	JVN	id:	JVNVU99362875	Trust: 0.8
db:	JVNDB	id:	JVNDB-2020-007432	Trust: 0.8
db:	CNVD	id:	CNVD-2020-49618	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2762	Trust: 0.6
db:	CNNVD	id:	CNNVD-202008-593	Trust: 0.6

sources: CNVD: CNVD-2020-49618 // JVNDB: JVNDB-2020-007432 // CNNVD: CNNVD-202008-593 // NVD: CVE-2020-14483

REFERENCES

url:	https://us-cert.cisa.gov/ics/advisories/icsa-20-224-03	Trust: 3.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14483	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu99362875	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2020-14483	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2762/	Trust: 0.6

sources: CNVD: CNVD-2020-49618 // JVNDB: JVNDB-2020-007432 // CNNVD: CNNVD-202008-593 // NVD: CVE-2020-14483

SOURCES

db:	CNVD	id:	CNVD-2020-49618
db:	JVNDB	id:	JVNDB-2020-007432
db:	CNNVD	id:	CNNVD-202008-593
db:	NVD	id:	CVE-2020-14483

LAST UPDATE DATE

2024-11-23T22:16:21.436000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-49618	date:	2020-08-31T00:00:00
db:	JVNDB	id:	JVNDB-2020-007432	date:	2020-08-13T00:00:00
db:	CNNVD	id:	CNNVD-202008-593	date:	2020-08-20T00:00:00
db:	NVD	id:	CVE-2020-14483	date:	2024-11-21T05:03:22.183

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-49618	date:	2020-08-31T00:00:00
db:	JVNDB	id:	JVNDB-2020-007432	date:	2020-08-13T00:00:00
db:	CNNVD	id:	CNNVD-202008-593	date:	2020-08-11T00:00:00
db:	NVD	id:	CVE-2020-14483	date:	2020-08-13T15:15:12.377