PT-2017-14962 · Software House · Ip-Acm Ethernet Door Module+1

David Tomaschik · Publicado 2017-12-31 · Atualizado 2019-10-03 · CVE-2017-17704

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Software House iStar Ultra versions through 6.5.2.20569

Description A door-unlocking issue was discovered when the Software House iStar Ultra is used with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra use a fixed AES key and IV for encryption in CBC mode, which allows for replay attacks of entire messages. Additionally, the lack of message authentication beyond the fixed AES key enables message forgery.

Recommendations For versions through 6.5.2.20569, consider disabling the IP-ACM Ethernet Door Module until a patch is available to prevent potential replay attacks and message forgery. Restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2017-17704

Produtos afetados

Ip-Acm Ethernet Door Module

Istar Ultra

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-17704 · Aviso do Fabricante
• https://systemoverlord.com/2017/12/18/cve-2017-17704-broken-cryptography-in-istar-ultra-ip-acm-by-software-house.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-17704 · Nota de Segurança