PT-2017-16356 · Belden Hirschmann · Gecko Lite Managed Switch

Publicado 2017-02-13 · Atualizado 2017-03-03 · CVE-2017-5163

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Belden Hirschmann GECKO Lite Managed switch versions 2.0.00 and prior

Description An issue was discovered where a copy of the configuration file, including hashes of user passwords, is saved to an accessible location without authentication by path traversal after an administrator downloads the file.

Recommendations For versions 2.0.00 and prior, consider restricting access to the configuration file and the location where it is saved to prevent unauthorized access until a fix is available. As a temporary workaround, restrict access to the affected area to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-5163

Produtos afetados

Gecko Lite Managed Switch

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5163 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02 · Correção
• http://securityfocus.com/bid/95815 · Nota
• https://osv.dev/vulnerability/CVE-2017-5163 · Aviso do Fabricante