PT-2017-19308 · Siemens · Siemens Apogee Pxc+1

Publicado 2017-10-23 · Atualizado 2023-05-09 · CVE-2017-9947

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens APOGEE PXC and TALON TC BACnet Automation Controllers versions prior to V3.5

Description A directory traversal issue could allow a remote attacker with network access to the integrated web server to obtain information on the structure of the file system of the affected devices. The attacker would need access to the network and the integrated web server on ports 80/tcp and 443/tcp.

Recommendations For versions prior to V3.5, update to version V3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the integrated web server on ports 80/tcp and 443/tcp to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-538

CWE-22

Identificadores relacionados

CVE-2017-9947

Produtos afetados

Siemens Apogee Pxc

Siemens Talon Tc Bacnet Automation Controllers

Referências · 7

• 🔥 https://github.com/RoseSecurity/APOLOGEE · Exploit
• 🔥 http://packetstormsecurity.com/files/169544/Siemens-APOGEE-PXC-TALON-TC-Authentication-Bypass.html · Exploit
• https://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-148078.pdf · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-148078.pdf · Aviso do Fabricante
• http://securityfocus.com/bid/101248 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9947 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9947 · Aviso do Fabricante