PT-2019-8011 · Orpak · Orpak Siteomat

Published 2019-06-03 · Updated 2019-06-04 · CVE-2017-14852

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orpak SiteOmat (affected versions not specified)

Description An insecure communication was found between a user and the Orpak SiteOmat management console due to an invalid SSL certificate. This allows an eavesdropper to capture the communication and decrypt the data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-310

Related Identifiers

CVE-2017-14852

Affected Products

Orpak Siteomat

References · 6

• https://osv.dev/vulnerability/CVE-2017-14852 · Vendor Advisory
• http://orpak.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14852 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01 · Note
• https://t.me/cibsecurity/4651 · Telegram Post
• http://securityfocus.com/bid/108167 · Note