PT-2015-6364 · Easyio · Easyio-30P-Sf

Maxim Rupp · Publicado 2015-09-28 · Atualizado 2015-09-29 · CVE-2015-3974

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EasyIO EasyIO-30P-SF controllers versions prior to 0.5.21 EasyIO EasyIO-30P-SF controllers versions 2.x prior to 2.0.5.21

Description The issue concerns a hardcoded password in the affected controllers, making it easier for remote attackers to obtain access. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For versions prior to 0.5.21, update the firmware to version 0.5.21 or later. For versions 2.x prior to 2.0.5.21, update the firmware to version 2.0.5.21 or later.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2015-3974

Produtos afetados

Easyio-30P-Sf

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-3974 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-15-237-02 · Nota