PT-2013-3925 · Schneider Electric · Trio J-Series License Free Ethernet Radio

Publicado 2013-08-28 · Atualizado 2013-08-29 · CVE-2013-2782

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric Trio J-Series License Free Ethernet Radio versions 3.6.0 through 3.6.3

Description The issue allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of the AES encryption key, which is the same across different customers' installations.

Recommendations For versions 3.6.0 through 3.6.3, consider contacting Schneider Electric for guidance on obtaining a unique AES encryption key for each installation as a mitigation measure.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-2782

Produtos afetados

Trio J-Series License Free Ethernet Radio

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2782 · Nota de Segurança
• http://schneider-electric.com/download/ww/en/file/141141292-SEVD-2013-143-01.pdf · Aviso do Fabricante
• http://ics-cert.us-cert.gov/advisories/ICSA-13-234-01 · Nota