PT-2019-7997 · Siteomat · Siteomat Bos

Publicado 2019-06-03 · Atualizado 2019-06-04 · CVE-2017-14728

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteOmat BOS versions prior to the fixed version

Description An authentication bypass issue was discovered in the SiteOmat source code, affecting all versions prior to the submission of this exploit. The issue is exacerbated by the fact that SiteOmat does not enforce password changes for administrators, leaving SSH and HTTP remote authentication vulnerable to public access.

Recommendations For all affected SiteOmat BOS versions, consider restricting access to SSH and HTTP remote authentication as a temporary mitigation measure until a patch is available. As a workaround, enforce password changes for administrators to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-14728

Produtos afetados

Siteomat Bos

Referências · 6

• http://orpak.com/allproducts/siteomat-station-controller-sw · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01 · Nota
• http://securityfocus.com/bid/108167 · Nota
• https://osv.dev/vulnerability/CVE-2017-14728 · Aviso do Fabricante
• https://t.me/cibsecurity/4654 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-14728 · Nota de Segurança