PT-2011-1682 · Webscada+4 · Webscada Ws100+6

Michael Orlando · Publicado 2011-02-14 · Atualizado 2011-02-15 · CVE-2010-4732

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebSCADA WS100 and WS200 versions (affected versions not specified) Easy Connect EC150 versions (affected versions not specified) Modbus RTU - TCP Gateway MB100 versions (affected versions not specified) Serial Ethernet Server SS100 versions (affected versions not specified) IntelliCom NetBiter NB100 and NB200 platforms versions (affected versions not specified)

Description The issue allows remote authenticated administrators to execute arbitrary code. This is achieved by using a config.html 2.conf action to replace the logo page's GIF image file with a file containing the code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-4732

Produtos afetados

Easy Connect Ec150

Intellicom Netbiter Nb100

Intellicom Netbiter Nb200

Modbus Rtu - Tcp Gateway Mb100

Serial Ethernet Server Ss100

Webscada Ws100

Webscada Ws200

Referências · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2010-10/0002.html · Exploit
• http://us-cert.gov/control_systems/pdf/ICSA-10-316-01A.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4732 · Nota de Segurança
• http://kb.cert.org/vuls/id/114560 · Nota