PT-2017-16356 · Belden Hirschmann · Gecko Lite Managed Switch

Published 2017-02-13 · Updated 2017-03-03 · CVE-2017-5163

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Belden Hirschmann GECKO Lite Managed switch versions 2.0.00 and prior

Description An issue was discovered where a copy of the configuration file, including hashes of user passwords, is saved to an accessible location without authentication by path traversal after an administrator downloads the file.

Recommendations For versions 2.0.00 and prior, consider restricting access to the configuration file and the location where it is saved to prevent unauthorized access until a fix is available. As a temporary workaround, restrict access to the affected area to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-5163

Affected Products

Gecko Lite Managed Switch

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5163 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02 · Patch
• https://osv.dev/vulnerability/CVE-2017-5163 · Vendor Advisory
• http://securityfocus.com/bid/95815 · Note