PT-2017-10084 · Eaton · Eaton Epdus Eswaxx+1

Maxim Rupp · Published 2017-02-13 · Updated 2017-03-16 · CVE-2016-9357

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eaton ePDUs EAMxxx versions prior to June 30, 2015 Eaton ePDUs EMAxxx versions prior to January 31, 2014 Eaton ePDUs EAMAxx versions prior to January 31, 2014 Eaton ePDUs EMAAxx versions prior to January 31, 2014 Eaton ePDUs ESWAxx versions prior to January 31, 2014

Description An issue allows an unauthenticated attacker to access configuration files using a specially crafted URL, which enables Path Traversal.

Recommendations For EAMxxx versions prior to June 30, 2015, consider restricting access to configuration files as a mitigation measure. For EMAxxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. For EAMAxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. For EMAAxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. For ESWAxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-9357

Affected Products

Eaton Epdus Eamaxx

Eaton Epdus Eswaxx

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9357 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9357 · Vendor Advisory
• http://securityfocus.com/bid/95817 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-026-01 · Note