PT-2016-4566 · Sprecher Automation · Sprecon-E Service Program

Published 2016-12-25 · Updated 2017-01-07 · CVE-2016-10041

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sprecher Automation SPRECON-E Service Program versions prior to 3.43 SP0

Description An issue in the SPRECON-E Service Program allows a non-admin user to execute telegram simulation under certain preconditions. This can occur when a user with a valid engineering account and access to a service computer with the program running exploits incorrect caching of client data. The prerequisites for this issue include a user having created an online connection, authenticated and authorized as an administrator, and executed telegram simulation before closing the online connection. A potential attacker would need a valid engineering account and access to a service/maintenance computer with the SPRECON-E Service Program running. Additionally, a valid admin user must have closed the service connection without closing the program after executing telegram simulation. There is no risk from external attackers.

Recommendations For versions prior to 3.43 SP0, update to version 3.43 SP0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SPRECON-E Service Program to authorized personnel and ensuring that admin users close the program after executing telegram simulation to prevent exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-10041

Affected Products

Sprecon-E Service Program

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10041 · Security Note
• https://sprecher-automation.com/en/it-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10041 · Vendor Advisory
• http://securityfocus.com/bid/95296 · Note