PT-2018-4963 · Shdesigns · Resident Download Manager

Nolan Ray · Published 2018-07-13 · Updated 2019-10-09 · CVE-2016-6567

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SHDesigns' Resident Download Manager (affected versions not specified)

Description The Resident Download Manager, used for firmware updates on Rabbit 2000/3000 CPU boards in some industrial control and embedded applications, does not verify the authenticity of firmware before execution and deployment. This allows a remote attacker, capable of sending UDP traffic to the device, to potentially execute arbitrary code on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

CWE-494

Related Identifiers

CVE-2016-6567

Affected Products

Resident Download Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-6567 · Security Note
• http://securityfocus.com/bid/95898 · Note
• https://kb.cert.org/vuls/id/167623 · Note