PT-2012-4445 · Tridium · Tridium Niagara Ax Framework

Publicado 2012-08-16 · Atualizado 2023-03-22 · CVE-2012-3024

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tridium Niagara AX Framework versions prior to 3.8 is not mentioned, however, it is mentioned that versions through 3.6 are affected. Therefore: Tridium Niagara AX Framework versions through 3.6

Description The issue is related to the use of predictable values for session IDs and keys, which could allow remote attackers to bypass authentication through a brute-force attack.

Recommendations For Tridium Niagara AX Framework versions through 3.6, consider implementing additional authentication measures to prevent brute-force attacks, such as account lockout policies or IP blocking, until a fixed version is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-3024

Produtos afetados

Tridium Niagara Ax Framework

Referências · 3

• http://us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf · Nota
• http://tridium.com/cs/tridium_news/security_patch_36 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3024 · Nota de Segurança