PT-2017-17986 · Advantech · Advantech B+B Smartworx Mesr901

Maxim Rupp · Publicado 2017-05-06 · Atualizado 2019-10-09 · CVE-2017-7909

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior

Description A Use of Client-Side Authentication issue was discovered in the web interface, which uses JavaScript to check client authentication and redirect unauthorized users. This allows attackers to intercept requests and bypass authentication, accessing restricted web pages.

Recommendations For Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior, consider disabling JavaScript authentication in the web interface as a temporary workaround until a patch is available. Restrict access to restricted web pages to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-603

CWE-287

Identificadores relacionados

CVE-2017-7909

Produtos afetados

Advantech B+B Smartworx Mesr901

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-7909 · Aviso do Fabricante
• http://securityfocus.com/bid/98257 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7909 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-17-122-03 · Nota