PT-2017-19305 · Siemens · Siemens 7Kt Pac1200

Published 2017-12-26 · Updated 2019-10-09 · CVE-2017-9944

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens 7KT PAC1200 data manager versions prior to V2.03

Description A vulnerability has been identified in the integrated web server of the affected devices, which could allow an unauthenticated remote attacker to perform administrative operations over the network. The issue affects the web server running on port 80/tcp.

Recommendations For versions prior to V2.03, update to version V2.03 or later to resolve the issue. As a temporary workaround, consider restricting access to the integrated web server on port 80/tcp to minimize the risk of exploitation.

Fix

Authentication Bypass Using an Alternate Path or Channel

Improper Privilege Management

Weakness Enumeration

CWE-288

CWE-269

Related Identifiers

CVE-2017-9944

Affected Products

Siemens 7Kt Pac1200

References · 4

• https://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-971654.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9944 · Security Note
• http://securityfocus.com/bid/101184 · Note