PT-2017-15472 · Siemens · Sinumerik Integrate Operate Clients

Publicado 2017-03-01 · Atualizado 2019-10-09 · CVE-2017-2685

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Siemens SINUMERIK Integrate Operate Clients versions 2.0.3.00.016 through 2.0.6 Siemens SINUMERIK Integrate Operate Clients versions 3.0.4.00.032 through 3.0.6

Description The issue allows an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack.

Recommendations For versions 2.0.3.00.016 through 2.0.6, update to a version outside of this range to resolve the issue. For versions 3.0.4.00.032 through 3.0.6, update to a version outside of this range to resolve the issue.

Correção

Information Disclosure

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-200

CWE-693

Identificadores relacionados

CVE-2017-2685

Produtos afetados

Sinumerik Integrate Operate Clients

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-2685 · Nota de Segurança
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-934525.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2685 · Aviso do Fabricante
• http://securityfocus.com/bid/96519 · Nota