PT-2017-3142 · Binom · Binom3 Universal Multifunctional Electric Power Quality Meter

Karn Ganeshen · Published 2017-01-31 · Updated 2017-02-16 · CVE-2017-5162

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BINOM3 Universal Multifunctional Electric Power Quality Meter (affected versions not specified)

Description The issue is related to the lack of authentication for remote services in the BINOM3 Universal Multifunctional Electric Power Quality Meter, which allows unauthorized access to the application setup and configuration. This could enable a remote attacker to gain access to the device and perform arbitrary configuration changes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2017-02552

CVE-2017-5162

Affected Products

Binom3 Universal Multifunctional Electric Power Quality Meter

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/binom3_login_config_pass_dump.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-5162 · Security Note
• https://bdu.fstec.ru/vul/2017-02552 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A · Note
• http://securityfocus.com/bid/93028 · Note