PT-2019-7997 · Siteomat · Siteomat Bos

Published 2019-06-03 · Updated 2019-06-04 · CVE-2017-14728

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteOmat BOS versions prior to the fixed version

Description An authentication bypass issue was discovered in the SiteOmat source code, affecting all versions prior to the submission of this exploit. The issue is exacerbated by the fact that SiteOmat does not enforce password changes for administrators, leaving SSH and HTTP remote authentication vulnerable to public access.

Recommendations For all affected SiteOmat BOS versions, consider restricting access to SSH and HTTP remote authentication as a temporary mitigation measure until a patch is available. As a workaround, enforce password changes for administrators to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-14728

Affected Products

Siteomat Bos

References · 6

• http://orpak.com/allproducts/siteomat-station-controller-sw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14728 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01 · Note
• http://securityfocus.com/bid/108167 · Note
• https://t.me/cibsecurity/4654 · Telegram Post