PT-2017-14362 · Amag · Amag Symmetry Door Edge Network Controllers

John Mocuta + 1 · Publicado 2017-12-10 · Atualizado 2019-10-03 · CVE-2017-16241

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AMAG Symmetry Door Edge Network Controllers versions 03.60 AMAG Symmetry Door Edge Network Controllers versions 01.00

Description The issue allows remote attackers to execute door controller commands, such as lock, unlock, or add ID card value, by sending unauthenticated requests to the affected devices via Serial over TCP/IP. This can be demonstrated by sending a Ud command.

Recommendations For AMAG Symmetry Door Edge Network Controllers version 03.60, update the device to a version that includes proper access control to prevent unauthenticated requests. For AMAG Symmetry Door Edge Network Controllers version 01.00, restrict access to the Serial over TCP/IP interface until a patch is available that addresses the incorrect access control issue.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2017-16241

Produtos afetados

Amag Symmetry Door Edge Network Controllers

Referências · 5

• 🔥 https://github.com/lixmk/Concierge · Exploit
• https://secureworks.com/research/advisory-2017-001 · Nota
• https://osv.dev/vulnerability/CVE-2017-16241 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16241 · Nota de Segurança
• https://hushcon.com/schedule.html · Nota