PT-2017-17986 · Advantech · Advantech B+B Smartworx Mesr901

Maxim Rupp · Published 2017-05-06 · Updated 2019-10-09 · CVE-2017-7909

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior

Description A Use of Client-Side Authentication issue was discovered in the web interface, which uses JavaScript to check client authentication and redirect unauthorized users. This allows attackers to intercept requests and bypass authentication, accessing restricted web pages.

Recommendations For Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior, consider disabling JavaScript authentication in the web interface as a temporary workaround until a patch is available. Restrict access to restricted web pages to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-603

CWE-287

Related Identifiers

CVE-2017-7909

Affected Products

Advantech B+B Smartworx Mesr901

References · 4

• https://osv.dev/vulnerability/CVE-2017-7909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7909 · Security Note
• http://securityfocus.com/bid/98257 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-122-03 · Note