PT-2015-2608 · Janitza · Janitza Umg

Published 2015-10-28 · Updated 2015-10-28 · CVE-2015-3968

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Janitza UMG devices versions 508, 509, 511, 604, 605

Description The issue is related to the FTP service on the devices, which has a default password. This makes it easier for remote attackers to read or write to files via a session on TCP port 21. The vulnerability can be exploited by creating a TCP session on port 21, allowing remote attackers to access files.

Recommendations For Janitza UMG devices versions 508, 509, 511, 604, 605, consider changing the default password for the FTP service to prevent unauthorized access. As a temporary workaround, restrict access to the FTP service on TCP port 21 to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

BDU:2015-11973

CVE-2015-3968

Affected Products

Janitza Umg

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-3968 · Security Note
• https://bdu.fstec.ru/vul/2015-11973 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03 · Patch