PT-2017-9635 · Lynxspring · Lynxspring Jenesys Bas Bridge

Maxim Rupp · Publicado 2017-02-13 · Atualizado 2017-02-17 · CVE-2016-8357

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lynxspring JENEsys BAS Bridge versions 1.1.8 and older

Description A user with read-only access can send commands to the software, and the application will accept those commands, allowing an attacker to make changes within the application.

Recommendations For versions 1.1.8 and older, restrict access to the software to prevent users with read-only access from sending commands. As a temporary workaround, consider disabling command execution for users with read-only access until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-8357

Produtos afetados

Lynxspring Jenesys Bas Bridge

Referências · 4

• http://securityfocus.com/bid/94344 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8357 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8357 · Aviso do Fabricante