PT-2018-6325 · Tridium · Niagara Ax Framework+1

Christopher Mazzei + 1 · Published 2018-08-20 · Updated 2019-04-03 · CVE-2017-16748

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Niagara AX Framework versions 3.8 and prior Niagara 4 Framework versions 4.4 and prior

Description: The issue allows an attacker to log into the local Niagara platform using a disabled account name and a blank password, resulting in administrator access to the Niagara system.

Recommendations: For Niagara AX Framework versions 3.8 and prior, update to a version later than 3.8 to resolve the issue. For Niagara 4 Framework versions 4.4 and prior, update to a version later than 4.4 to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-16748

Affected Products

Niagara 4 Framework

Niagara Ax Framework

References · 5

• https://osv.dev/vulnerability/CVE-2017-16748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16748 · Security Note
• http://securityfocus.com/bid/105101 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03 · Note