PT-2017-3142 · Binom · Binom3 Universal Multifunctional Electric Power Quality Meter

Karn Ganeshen · Publicado 2017-01-31 · Atualizado 2017-02-16 · CVE-2017-5162

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BINOM3 Universal Multifunctional Electric Power Quality Meter (affected versions not specified)

Description The issue is related to the lack of authentication for remote services in the BINOM3 Universal Multifunctional Electric Power Quality Meter, which allows unauthorized access to the application setup and configuration. This could enable a remote attacker to gain access to the device and perform arbitrary configuration changes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BDU:2017-02552

CVE-2017-5162

Produtos afetados

Binom3 Universal Multifunctional Electric Power Quality Meter

Referências · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/binom3_login_config_pass_dump.rb · Exploit
• https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5162 · Nota de Segurança
• http://securityfocus.com/bid/93028 · Nota
• https://bdu.fstec.ru/vul/2017-02552 · Nota de Segurança