PT-2016-4566 · Sprecher Automation · Sprecon-E Service Program

Publicado 2016-12-25 · Atualizado 2017-01-07 · CVE-2016-10041

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sprecher Automation SPRECON-E Service Program versions prior to 3.43 SP0

Description An issue in the SPRECON-E Service Program allows a non-admin user to execute telegram simulation under certain preconditions. This can occur when a user with a valid engineering account and access to a service computer with the program running exploits incorrect caching of client data. The prerequisites for this issue include a user having created an online connection, authenticated and authorized as an administrator, and executed telegram simulation before closing the online connection. A potential attacker would need a valid engineering account and access to a service/maintenance computer with the SPRECON-E Service Program running. Additionally, a valid admin user must have closed the service connection without closing the program after executing telegram simulation. There is no risk from external attackers.

Recommendations For versions prior to 3.43 SP0, update to version 3.43 SP0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SPRECON-E Service Program to authorized personnel and ensuring that admin users close the program after executing telegram simulation to prevent exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-10041

Produtos afetados

Sprecon-E Service Program

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10041 · Nota de Segurança
• https://sprecher-automation.com/en/it-security · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-10041 · Aviso do Fabricante
• http://securityfocus.com/bid/95296 · Nota