PT-2012-4445 · Tridium · Tridium Niagara Ax Framework

Published 2012-08-16 · Updated 2023-03-22 · CVE-2012-3024

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tridium Niagara AX Framework versions prior to 3.8 is not mentioned, however, it is mentioned that versions through 3.6 are affected. Therefore: Tridium Niagara AX Framework versions through 3.6

Description The issue is related to the use of predictable values for session IDs and keys, which could allow remote attackers to bypass authentication through a brute-force attack.

Recommendations For Tridium Niagara AX Framework versions through 3.6, consider implementing additional authentication measures to prevent brute-force attacks, such as account lockout policies or IP blocking, until a fixed version is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-3024

Affected Products

Tridium Niagara Ax Framework

References · 3

• http://tridium.com/cs/tridium_news/security_patch_36 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3024 · Security Note
• http://us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf · Note