PT-2017-12657 · Westermo · Westermo Mrd-315+3

Published 2017-08-25 · Updated 2017-08-29 · CVE-2017-12703

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Westermo MRD-305-DIN versions prior to 1.7.5.0 Westermo MRD-315 versions prior to 1.7.5.0 Westermo MRD-355 versions prior to 1.7.5.0 Westermo MRD-455 versions prior to 1.7.5.0

Description A Cross-Site Request Forgery issue was discovered, where the application fails to verify if a request was intentionally provided by the user. This allows an attacker to trick a user into making a malicious request to the server.

Recommendations For Westermo MRD-305-DIN versions prior to 1.7.5.0, update to version 1.7.5.0 or later. For Westermo MRD-315 versions prior to 1.7.5.0, update to version 1.7.5.0 or later. For Westermo MRD-355 versions prior to 1.7.5.0, update to version 1.7.5.0 or later. For Westermo MRD-455 versions prior to 1.7.5.0, update to version 1.7.5.0 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-12703

Affected Products

Westermo Mrd-305-Din

Westermo Mrd-315

Westermo Mrd-355

Westermo Mrd-455

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-12703 · Security Note
• http://securityfocus.com/bid/100470 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-236-01 · Note