CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVE-2002-2438 (GCVE-0-2002-2438)
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-08T04:06:55.369Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/8" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/4" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/12" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/11" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/13" }, { "name": "[oss-security] 20120203 Re: CVE Request (2002): Linux TCP stack could accept invalid TCP flag combinations", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/02/03/7" }, { "name": "[oss-security] 20120529 Re: CVE Request (2002): Linux TCP stack could accept invalid TCP flag combinations", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/29/8" }, { "name": "[oss-security] 20140212 Re: Old CVE ids, public, but still \"RESERVED\"", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2014/02/12/8" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/9" }, { "name": "[oss-security] 20120531 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/31/3" }, { "name": "[oss-security] 20120530 CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/2" }, { "name": "VU#464113", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "https://www.kb.cert.org/vuls/id/464113" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.kb.cert.org/vuls/id/464113%2C" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=744994%2C" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.openwall.com/lists/oss-security/2012/02/03/7" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20210727-0003/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "kernel", "vendor": "n/a", "versions": [ { "status": "affected", "version": "before Linux kernel 2.4.20" } ] } ], "descriptions": [ { "lang": "en", "value": "TCP firewalls could be circumvented by sending a SYN Packets with other flags (like e.g. RST flag) set, which was not correctly discarded by the Linux TCP stack after firewalling." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2021-07-27T15:06:22", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/8" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/4" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/12" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/11" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/13" }, { "name": "[oss-security] 20120203 Re: CVE Request (2002): Linux TCP stack could accept invalid TCP flag combinations", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/02/03/7" }, { "name": "[oss-security] 20120529 Re: CVE Request (2002): Linux TCP stack could accept invalid TCP flag combinations", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/29/8" }, { "name": "[oss-security] 20140212 Re: Old CVE ids, public, but still \"RESERVED\"", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2014/02/12/8" }, { "name": "[oss-security] 20120530 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/9" }, { "name": "[oss-security] 20120531 Re: CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/31/3" }, { "name": "[oss-security] 20120530 CVE Request -- kernel: tcp: drop SYN+FIN messages", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2012/05/30/2" }, { "name": "VU#464113", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "https://www.kb.cert.org/vuls/id/464113" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.kb.cert.org/vuls/id/464113%2C" }, { "tags": [ "x_refsource_MISC" ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=744994%2C" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.openwall.com/lists/oss-security/2012/02/03/7" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20210727-0003/" } ] } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2002-2438", "datePublished": "2021-05-18T11:36:47", "dateReserved": "2012-01-04T00:00:00", "dateUpdated": "2024-08-08T04:06:55.369Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2011-2054 (GCVE-0-2011-2054)
Vulnerability from cvelistv5
- CWE-287 - Improper Authentication
► | URL | Tags | |||
---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T22:46:00.884Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2011-2054", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-15T16:29:28.157200Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-15T17:41:33.434Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Cisco ASA", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "8.4(1)" } ] } ], "datePublic": "2011-11-02T00:00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability." } ], "exploits": [ { "lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-02-19T03:05:13", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884" } ], "source": { "advisory": "CSCtq58884", "defect": [ "CSCut66725" ], "discovery": "USER" }, "title": "Cisco ASA Secondary Authentication Bypass Vulnerability", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2011-11-02T15:00:00.000Z", "ID": "CVE-2011-2054", "STATE": "PUBLIC", "TITLE": "Cisco ASA Secondary Authentication Bypass Vulnerability" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Cisco ASA", "version": { "version_data": [ { "version_affected": "=", "version_value": "8.4(1)" } ] } } ] }, "vendor_name": "Cisco" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability." } ] }, "exploit": [ { "lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-287 Improper Authentication" } ] } ] }, "references": { "reference_data": [ { "name": "https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884", "refsource": "MISC", "url": "https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884" } ] }, "source": { "advisory": "CSCtq58884", "defect": [ "CSCut66725" ], "discovery": "USER" } } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2011-2054", "datePublished": "2020-02-19T03:05:13.966780Z", "dateReserved": "2011-05-10T00:00:00", "dateUpdated": "2024-11-15T17:41:33.434Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2012-5864 (GCVE-0-2012-5864)
Vulnerability from cvelistv5
► | URL | Tags | |||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Sinapsi | eSolar |
Version: 0 < 2.0.2870_xxx_2.2.12 |
|||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T21:21:27.322Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "21273", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "url": "http://www.exploit-db.com/exploits/21273/" }, { "name": "sinapsi-sec-bypass(80203)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80203" }, { "name": "20120911 Multiple vulnerabilities in Ezylog photovoltaic management server", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "eSolar", "vendor": "Sinapsi", "versions": [ { "lessThan": "2.0.2870_xxx_2.2.12", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "eSolar DUO", "vendor": "Sinapsi", "versions": [ { "lessThan": "2.0.2870_xxx_2.2.12", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "eSolar Light", "vendor": "Sinapsi", "versions": [ { "lessThan": "2.0.2870_xxx_2.2.12", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Roberto Paleari and Ivan Speziale identified vulnerabilities and released proof-of-concept (exploit) code for the Sinapsi eSolar Light Photovoltaic System Monitor without coordination with Sinapsi or ICS-CERT." } ], "datePublic": "2012-09-11T06:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "These Sinapsi devices \ndo not check if users that visit pages within the device have properly \nauthenticated. By directly visiting the pages within the device, \nattackers can gain unauthorized access with administrative privileges." } ], "value": "These Sinapsi devices \ndo not check if users that visit pages within the device have properly \nauthenticated. By directly visiting the pages within the device, \nattackers can gain unauthorized access with administrative privileges." } ], "metrics": [ { "cvssV2_0": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 9.4, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:N", "version": "2.0" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-07-08T15:27:10.014Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "name": "21273", "tags": [ "exploit", "x_refsource_EXPLOIT-DB" ], "url": "http://www.exploit-db.com/exploits/21273/" }, { "name": "20120911 Multiple vulnerabilities in Ezylog photovoltaic management server", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html" }, { "name": "sinapsi-default-password(80200)", "tags": [ "vdb-entry", "x_refsource_XF" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Sinapsi has developed a new firmware version 2.0.2870_2.2.12 that \nmitigates these vulnerabilities. Sinapsi released the new firmware on \nMonday, November 19, 2012 directly to the devices. Users will be able to\n manually download the firmware on their device by using the Firmware \nUpdate function in the System Menu in the device\u2019s Web interface. \nSinapsi has also posted a security newsletter to its \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.sinapsitech.it/default.asp?active_page_id=78\u0026amp;news_id=88\"\u003epublic Web site\u003c/a\u003e\u0026nbsp;.\u003cp\u003eOther affected vendors have been notified by Sinapsi and ICS-CERT, \nbut the availability of new firmware upgrades are unknown by ICS-CERT at\n this time.\u003c/p\u003e\n\n\u003cbr\u003e" } ], "value": "Sinapsi has developed a new firmware version 2.0.2870_2.2.12 that \nmitigates these vulnerabilities. Sinapsi released the new firmware on \nMonday, November 19, 2012 directly to the devices. Users will be able to\n manually download the firmware on their device by using the Firmware \nUpdate function in the System Menu in the device\u2019s Web interface. \nSinapsi has also posted a security newsletter to its public Web site http://www.sinapsitech.it/default.asp \u00a0.Other affected vendors have been notified by Sinapsi and ICS-CERT, \nbut the availability of new firmware upgrades are unknown by ICS-CERT at\n this time." } ], "source": { "advisory": "ICSA-12-325-01", "discovery": "EXTERNAL" }, "title": "Sinapsi eSolar Improper Authentication", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2012-5862", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "login.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 establishes multiple hardcoded accounts, which makes it easier for remote attackers to obtain administrative access by leveraging a (1) cleartext password or (2) password hash contained in this script, as demonstrated by a password of astridservice or 36e44c9b64." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "21273", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/21273/" }, { "name": "20120911 Multiple vulnerabilities in Ezylog photovoltaic management server", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html" }, { "name": "sinapsi-default-password(80200)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200" }, { "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf", "refsource": "MISC", "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf" }, { "name": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88", "refsource": "CONFIRM", "url": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2012-5864", "datePublished": "2012-11-23T11:00:00", "dateReserved": "2012-11-14T00:00:00", "dateUpdated": "2025-07-08T15:27:10.014Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2012-6437 (GCVE-0-2012-6437)
Vulnerability from cvelistv5
► | URL | Tags | |||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Rockwell Automation | 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules |
Version: All |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T21:28:39.934Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "CompactLogix L32E and L35E controllers", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "1788-ENBT FLEXLogix adapter", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "1794-AENTR FLEX I/O EtherNet/IP adapter", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "ControlLogix, CompactLogix, GuardLogix, and SoftLogix", "vendor": "Rockwell Automation", "versions": [ { "lessThanOrEqual": "18", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "CompactLogix and SoftLogix controllers", "vendor": "Rockwell Automation", "versions": [ { "lessThanOrEqual": "19", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "ControlLogix and GuardLogix controllers", "vendor": "Rockwell Automation", "versions": [ { "lessThanOrEqual": "20", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "MicroLogix", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "1100" }, { "status": "affected", "version": "1400" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Rub\u00e9n Santamarta of IOActive identified vulnerabilities in Rockwell Automation\u2019s ControlLogix PLC and released proof-of-concept (exploit) code at the Digital Bond S4 Conference on January 19, 2012." } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003e\n\n\n\n\n\n\n\n\n\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause loss of availability, integrity, and confidentiality and a disruption in communications with other connected devices.\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/p\u003e\u003cp\u003eRockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400\u0026nbsp;\u003cbr\u003e\u003c/p\u003e" } ], "value": "The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause loss of availability, integrity, and confidentiality and a disruption in communications with other connected devices.\n\n\n\n\n\nRockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400" } ], "metrics": [ { "cvssV2_0": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-06-30T22:05:18.667Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03" }, { "url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154" }, { "url": "https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155" }, { "url": "https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156" }, { "url": "http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eAccording to Rockwell, any of the above products that become affected by a vulnerability can be reset by rebooting or power cycling the affected product. After the reboot, the affected product may require some reconfiguration.\u003c/p\u003e\u003cp\u003eTo mitigate the vulnerabilities, Rockwell has developed and released security patches on July 18, 2012, to address each of the issues. To download and install the patches please refer to Rockwell\u2019s Advisories at:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154\u003c/a\u003e\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/aid/470155\u003c/a\u003e\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/aid/470156\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor more information on security with Rockwell Automation products, please refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102\"\u003eRockwell\u2019s Security Advisory Index\u003c/a\u003e.\u003c/p\u003e" } ], "value": "According to Rockwell, any of the above products that become affected by a vulnerability can be reset by rebooting or power cycling the affected product. After the reboot, the affected product may require some reconfiguration.\n\nTo mitigate the vulnerabilities, Rockwell has developed and released security patches on July 18, 2012, to address each of the issues. To download and install the patches please refer to Rockwell\u2019s Advisories at:\n\n https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154 \n https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155 \n https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156 \n\nFor more information on security with Rockwell Automation products, please refer to Rockwell\u2019s Security Advisory Index http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102 ." } ], "source": { "advisory": "ICSA-13-011-03", "discovery": "EXTERNAL" }, "title": "Rockwell Automation ControlLogix PLC Improper Authentication", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eRockwell recommends updating to the newest firmware patches to fix the vulnerabilities, but if not able to do so right away, then Rockwell advises immediately employing the following mitigations for each of the affected products.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eTo mitigate the vulnerability with the Web server password authentication mechanism:\u003c/p\u003e\u003col\u003e\u003cli\u003eUpgrade the MicroLogix 1400 firmware to FRN 12 or higher.\u003c/li\u003e\u003cli\u003eBecause of limitations in the MicroLogix 1100 platform, none of the firmware updates will be able to fix this issue, so users should use the following techniques to help reduce the likelihood of compromise.\u003c/li\u003e\u003cli\u003eWhere possible, disable the Web server and change all default Administrator and Guest passwords.\u003c/li\u003e\u003cli\u003eIf Web server functionality is needed, then Rockwell recommends upgrading the product\u2019s firmware to the most current version to have the newest enhanced protections available such as:\u003col\u003e\u003cli\u003eWhen a controller receives two consecutive invalid authentication requests from an HTTP client, the controller resets the Authentication Counter after 60 minutes.\u003c/li\u003e\u003cli\u003eWhen a controller receives 10 invalid authentication requests from any HTTP client, it will not accept any valid or invalid authentication packets until a 24-hour HTTP Server Lock Timer timeout.\u003c/li\u003e\u003c/ol\u003e\u003c/li\u003e\u003cli\u003eIf Web server functionality is needed, Rockwell also recommends configuring user accounts to have READ only access to the product so those accounts cannot be used to make configuration change\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eIn addition to the above, Rockwell recommends concerned customers remain vigilant and continue to follow security strategies that help reduce risk and enhance overall control system security. Where possible, they suggest you apply multiple recommendations and complement this list with your own best-practices:\u003c/p\u003e\u003col\u003e\u003cli\u003eEmploy layered security and defense-in-depth methods in system design to restrict and control access to individual products and control networks. Refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.ab.com/networks/architectures.html\"\u003ehttp://www.ab.com/networks/architectures.html\u003c/a\u003e for comprehensive information about implementing validated architectures designed to deliver these measures.\u003c/li\u003e\u003cli\u003eRestrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment.\u003c/li\u003e\u003cli\u003eEmploy firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked.\u003c/li\u003e\u003cli\u003eUse up-to-date end-point protection software (e.g., antivirus/antimalware software) on all PC-based assets.\u003c/li\u003e\u003cli\u003eMake sure that software and control system device firmware is patched to current releases.\u003c/li\u003e\u003cli\u003ePeriodically change passwords in control system components and infrastructure devices.\u003c/li\u003e\u003cli\u003eWhere applicable, set the controller key-switch/mode-switch to RUN mode.\u003c/li\u003e\u003c/ol\u003e\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFor more information on security with Rockwell Automation products, please refer to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102\"\u003eRockwell\u2019s Security Advisory Index\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\n\n\u003cbr\u003e" } ], "value": "Rockwell recommends updating to the newest firmware patches to fix the vulnerabilities, but if not able to do so right away, then Rockwell advises immediately employing the following mitigations for each of the affected products.\n\n\n\n\n\nTo mitigate the vulnerability with the Web server password authentication mechanism:\n\n * Upgrade the MicroLogix 1400 firmware to FRN 12 or higher.\n * Because of limitations in the MicroLogix 1100 platform, none of the firmware updates will be able to fix this issue, so users should use the following techniques to help reduce the likelihood of compromise.\n * Where possible, disable the Web server and change all default Administrator and Guest passwords.\n * If Web server functionality is needed, then Rockwell recommends upgrading the product\u2019s firmware to the most current version to have the newest enhanced protections available such as: * When a controller receives two consecutive invalid authentication requests from an HTTP client, the controller resets the Authentication Counter after 60 minutes.\n * When a controller receives 10 invalid authentication requests from any HTTP client, it will not accept any valid or invalid authentication packets until a 24-hour HTTP Server Lock Timer timeout.\n\n * If Web server functionality is needed, Rockwell also recommends configuring user accounts to have READ only access to the product so those accounts cannot be used to make configuration change\nIn addition to the above, Rockwell recommends concerned customers remain vigilant and continue to follow security strategies that help reduce risk and enhance overall control system security. Where possible, they suggest you apply multiple recommendations and complement this list with your own best-practices:\n\n * Employ layered security and defense-in-depth methods in system design to restrict and control access to individual products and control networks. Refer to http://www.ab.com/networks/architectures.html for comprehensive information about implementing validated architectures designed to deliver these measures.\n * Restrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment.\n * Employ firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked.\n * Use up-to-date end-point protection software (e.g., antivirus/antimalware software) on all PC-based assets.\n * Make sure that software and control system device firmware is patched to current releases.\n * Periodically change passwords in control system components and infrastructure devices.\n * Where applicable, set the controller key-switch/mode-switch to RUN mode.\n\n\n\n\nFor more information on security with Rockwell Automation products, please refer to Rockwell\u2019s Security Advisory Index http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102 ." } ], "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2012-6439", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 allow remote attackers to cause a denial of service (control and communication outage) via a CIP message that modifies the (1) configuration or (2) network parameters." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf", "refsource": "MISC", "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2012-6437", "datePublished": "2013-01-24T21:00:00Z", "dateReserved": "2012-12-26T00:00:00Z", "dateUpdated": "2025-06-30T22:05:18.667Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2012-6440 (GCVE-0-2012-6440)
Vulnerability from cvelistv5
► | URL | Tags | |||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Rockwell Automation | 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules |
Version: All |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T21:28:39.932Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "CompactLogix L32E and L35E controllers", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "1788-ENBT FLEXLogix adapter", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "1794-AENTR FLEX I/O EtherNet/IP adapter", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "All" } ] }, { "defaultStatus": "unaffected", "product": "ControlLogix, CompactLogix, GuardLogix, and SoftLogix", "vendor": "Rockwell Automation", "versions": [ { "lessThanOrEqual": "18", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "CompactLogix and SoftLogix controllers", "vendor": "Rockwell Automation", "versions": [ { "lessThanOrEqual": "19", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "ControlLogix and GuardLogix controllers", "vendor": "Rockwell Automation", "versions": [ { "lessThanOrEqual": "20", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "MicroLogix", "vendor": "Rockwell Automation", "versions": [ { "status": "affected", "version": "1100" }, { "status": "affected", "version": "1400" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "This vulnerability was discovered by Rockwell Automation engineers as they were investigating other vulnerabilities reported at the Digital Bond S4 2012 Conference." } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003e\n\n\n\n\n\n\n\n\n\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product\u2019s Web server to view and alter product configuration and diagnostics information.\u003c/span\u003e\n\n\u003c/p\u003e\u003cp\u003eRockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400\u0026nbsp;\u003cbr\u003e\u003c/p\u003e" } ], "value": "The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product\u2019s Web server to view and alter product configuration and diagnostics information.\n\n\n\nRockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400" } ], "metrics": [ { "cvssV2_0": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-06-30T22:03:01.214Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03" }, { "url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154" }, { "url": "https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155" }, { "url": "https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156" }, { "url": "http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eAccording to Rockwell, any of the above products that become affected by a vulnerability can be reset by rebooting or power cycling the affected product. After the reboot, the affected product may require some reconfiguration.\u003c/p\u003e\u003cp\u003eTo mitigate the vulnerabilities, Rockwell has developed and released security patches on July 18, 2012, to address each of the issues. To download and install the patches please refer to Rockwell\u2019s Advisories at:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154\u003c/a\u003e\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/aid/470155\u003c/a\u003e\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/aid/470156\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor more information on security with Rockwell Automation products, please refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102\"\u003eRockwell\u2019s Security Advisory Index\u003c/a\u003e.\u003c/p\u003e" } ], "value": "According to Rockwell, any of the above products that become affected by a vulnerability can be reset by rebooting or power cycling the affected product. After the reboot, the affected product may require some reconfiguration.\n\nTo mitigate the vulnerabilities, Rockwell has developed and released security patches on July 18, 2012, to address each of the issues. To download and install the patches please refer to Rockwell\u2019s Advisories at:\n\n https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154 \n https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155 \n https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156 \n\nFor more information on security with Rockwell Automation products, please refer to Rockwell\u2019s Security Advisory Index http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102 ." } ], "source": { "advisory": "ICSA-13-011-03", "discovery": "INTERNAL" }, "title": "Rockwell Automation ControlLogix PLC Improper Input Validation", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eRockwell recommends updating to the newest firmware patches to fix the vulnerabilities, but if not able to do so right away, then Rockwell advises immediately employing the following mitigations for each of the affected products.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eTo mitigate the vulnerability with the Web server password authentication mechanism:\u003c/p\u003e\u003col\u003e\u003cli\u003eUpgrade the MicroLogix 1400 firmware to FRN 12 or higher.\u003c/li\u003e\u003cli\u003eBecause of limitations in the MicroLogix 1100 platform, none of the firmware updates will be able to fix this issue, so users should use the following techniques to help reduce the likelihood of compromise.\u003c/li\u003e\u003cli\u003eWhere possible, disable the Web server and change all default Administrator and Guest passwords.\u003c/li\u003e\u003cli\u003eIf Web server functionality is needed, then Rockwell recommends upgrading the product\u2019s firmware to the most current version to have the newest enhanced protections available such as:\u003col\u003e\u003cli\u003eWhen a controller receives two consecutive invalid authentication requests from an HTTP client, the controller resets the Authentication Counter after 60 minutes.\u003c/li\u003e\u003cli\u003eWhen a controller receives 10 invalid authentication requests from any HTTP client, it will not accept any valid or invalid authentication packets until a 24-hour HTTP Server Lock Timer timeout.\u003c/li\u003e\u003c/ol\u003e\u003c/li\u003e\u003cli\u003eIf Web server functionality is needed, Rockwell also recommends configuring user accounts to have READ only access to the product so those accounts cannot be used to make configuration change\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eIn addition to the above, Rockwell recommends concerned customers remain vigilant and continue to follow security strategies that help reduce risk and enhance overall control system security. Where possible, they suggest you apply multiple recommendations and complement this list with your own best-practices:\u003c/p\u003e\u003col\u003e\u003cli\u003eEmploy layered security and defense-in-depth methods in system design to restrict and control access to individual products and control networks. Refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.ab.com/networks/architectures.html\"\u003ehttp://www.ab.com/networks/architectures.html\u003c/a\u003e for comprehensive information about implementing validated architectures designed to deliver these measures.\u003c/li\u003e\u003cli\u003eRestrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment.\u003c/li\u003e\u003cli\u003eEmploy firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked.\u003c/li\u003e\u003cli\u003eUse up-to-date end-point protection software (e.g., antivirus/antimalware software) on all PC-based assets.\u003c/li\u003e\u003cli\u003eMake sure that software and control system device firmware is patched to current releases.\u003c/li\u003e\u003cli\u003ePeriodically change passwords in control system components and infrastructure devices.\u003c/li\u003e\u003cli\u003eWhere applicable, set the controller key-switch/mode-switch to RUN mode.\u003c/li\u003e\u003c/ol\u003e\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFor more information on security with Rockwell Automation products, please refer to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102\"\u003eRockwell\u2019s Security Advisory Index\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\n\n\u003cbr\u003e" } ], "value": "Rockwell recommends updating to the newest firmware patches to fix the vulnerabilities, but if not able to do so right away, then Rockwell advises immediately employing the following mitigations for each of the affected products.\n\n\n\n\n\nTo mitigate the vulnerability with the Web server password authentication mechanism:\n\n * Upgrade the MicroLogix 1400 firmware to FRN 12 or higher.\n * Because of limitations in the MicroLogix 1100 platform, none of the firmware updates will be able to fix this issue, so users should use the following techniques to help reduce the likelihood of compromise.\n * Where possible, disable the Web server and change all default Administrator and Guest passwords.\n * If Web server functionality is needed, then Rockwell recommends upgrading the product\u2019s firmware to the most current version to have the newest enhanced protections available such as: * When a controller receives two consecutive invalid authentication requests from an HTTP client, the controller resets the Authentication Counter after 60 minutes.\n * When a controller receives 10 invalid authentication requests from any HTTP client, it will not accept any valid or invalid authentication packets until a 24-hour HTTP Server Lock Timer timeout.\n\n * If Web server functionality is needed, Rockwell also recommends configuring user accounts to have READ only access to the product so those accounts cannot be used to make configuration change\nIn addition to the above, Rockwell recommends concerned customers remain vigilant and continue to follow security strategies that help reduce risk and enhance overall control system security. Where possible, they suggest you apply multiple recommendations and complement this list with your own best-practices:\n\n * Employ layered security and defense-in-depth methods in system design to restrict and control access to individual products and control networks. Refer to http://www.ab.com/networks/architectures.html for comprehensive information about implementing validated architectures designed to deliver these measures.\n * Restrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment.\n * Employ firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked.\n * Use up-to-date end-point protection software (e.g., antivirus/antimalware software) on all PC-based assets.\n * Make sure that software and control system device firmware is patched to current releases.\n * Periodically change passwords in control system components and infrastructure devices.\n * Where applicable, set the controller key-switch/mode-switch to RUN mode.\n\n\n\n\nFor more information on security with Rockwell Automation products, please refer to Rockwell\u2019s Security Advisory Index http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102 ." } ], "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2012-6439", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 allow remote attackers to cause a denial of service (control and communication outage) via a CIP message that modifies the (1) configuration or (2) network parameters." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf", "refsource": "MISC", "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2012-6440", "datePublished": "2013-01-24T21:00:00Z", "dateReserved": "2012-12-26T00:00:00Z", "dateUpdated": "2025-06-30T22:03:01.214Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2013-10004 (GCVE-0-2013-10004)
Vulnerability from cvelistv5
- CWE-287 - Improper Authentication
► | URL | Tags | ||||||
---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
Telecommunication Software | SAMwin Contact Center Suite |
Version: 5.1 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T18:09:17.117Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txt" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://vuldb.com/?id.12790" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2013-10004", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-04-14T16:56:49.362757Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-04-15T14:38:50.861Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "SAMwin Contact Center Suite", "vendor": "Telecommunication Software", "versions": [ { "status": "affected", "version": "5.1" } ] } ], "credits": [ { "lang": "en", "value": "Tobias Ospelt/Max Moser" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwordScramble in the library SAMwinLIBVB.dll of the component Password Handler. Incorrect implementation of a hashing function leads to predictable authentication possibilities. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-05-24T15:30:31.000Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "http://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txt" }, { "tags": [ "x_refsource_MISC" ], "url": "https://vuldb.com/?id.12790" } ], "title": "Telecommunication Software SAMwin Contact Center Suite Password SAMwinLIBVB.dll passwordScramble improper authentication", "x_generator": "vuldb.com", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cna@vuldb.com", "ID": "CVE-2013-10004", "REQUESTER": "cna@vuldb.com", "STATE": "PUBLIC", "TITLE": "Telecommunication Software SAMwin Contact Center Suite Password SAMwinLIBVB.dll passwordScramble improper authentication" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SAMwin Contact Center Suite", "version": { "version_data": [ { "version_value": "5.1" } ] } } ] }, "vendor_name": "Telecommunication Software" } ] } }, "credit": "Tobias Ospelt/Max Moser", "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwordScramble in the library SAMwinLIBVB.dll of the component Password Handler. Incorrect implementation of a hashing function leads to predictable authentication possibilities. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component." } ] }, "generator": "vuldb.com", "impact": { "cvss": { "baseScore": "6.5", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-287 Improper Authentication" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txt", "refsource": "MISC", "url": "http://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txt" }, { "name": "https://vuldb.com/?id.12790", "refsource": "MISC", "url": "https://vuldb.com/?id.12790" } ] } } } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2013-10004", "datePublished": "2022-05-24T15:30:31.000Z", "dateReserved": "2022-05-24T00:00:00.000Z", "dateUpdated": "2025-04-15T14:38:50.861Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2014-0760 (GCVE-0-2014-0760)
Vulnerability from cvelistv5
Vendor | Product | Version | ||
---|---|---|---|---|
► | Festo | CECX-X-C1 Modular Master Controller with CoDeSys |
Version: all |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T09:27:19.510Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "CECX-X-C1 Modular Master Controller with CoDeSys", "vendor": "Festo", "versions": [ { "status": "affected", "version": "all" } ] }, { "defaultStatus": "unaffected", "product": "CECX-X-M1 Modular Controller with CoDeSys and SoftMotion", "vendor": "Festo", "versions": [ { "status": "affected", "version": "all" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "K. Reid Wightman of IOActive, Inc. has identified vulnerabilities in Festo\u2019s CECX-X-C1 and CECX-X-M1 controllers." } ], "datePublic": "2014-04-24T06:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003e\nThe Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1\n Modular Controller with CoDeSys and SoftMotion provide an undocumented \naccess method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application \ncrash) via unspecified vectors.\n\n\u003c/p\u003e" } ], "value": "The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1\n Modular Controller with CoDeSys and SoftMotion provide an undocumented \naccess method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application \ncrash) via unspecified vectors." } ], "metrics": [ { "cvssV2_0": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-07-02T20:29:50.796Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01" } ], "source": { "advisory": "ICSA-14-084-01", "discovery": "EXTERNAL" }, "title": "Festo CECX-X-(C1/M1) Controller Improper Authentication", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eFesto has decided not to resolve these vulnerabilities, placing \ncritical infrastructure asset owners using this product at risk. This \nadvisory is being published to alert critical infrastructure asset \nowners of the risk of using this equipment, and to increase compensating\n security measures if possible.\u0026nbsp;Some of these compensating measures can be:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMinimize network exposure for all control system devices and/or \nsystems, and ensure that they are not accessible from the Internet.\u003c/li\u003e\n\u003cli\u003eLocate control system networks and remote devices behind firewalls, and isolate them from the business network.\u003c/li\u003e\n\u003cli\u003eWhen remote access is required, use secure methods, such as Virtual \nPrivate Networks (VPNs), recognizing that VPNs may have vulnerabilities \nand should be updated to the most current version available. Also \nrecognize that VPN is only as secure as the connected devices.\u003c/li\u003e\n\u003cli\u003eInvestigate the practicality of configuring and deploying an \nintrusion detection system (IDS) to log and monitor the control system \nnetwork, as well as adjacent networks.\u003c/li\u003e\n\u003cli\u003eConfigure, activate, and test existing defenses, such as port \nsecurity and traffic logging, among other defensive strategies in the \nrecommended practices document listed below.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cbr\u003e" } ], "value": "Festo has decided not to resolve these vulnerabilities, placing \ncritical infrastructure asset owners using this product at risk. This \nadvisory is being published to alert critical infrastructure asset \nowners of the risk of using this equipment, and to increase compensating\n security measures if possible.\u00a0Some of these compensating measures can be:\n\n\n\n * Minimize network exposure for all control system devices and/or \nsystems, and ensure that they are not accessible from the Internet.\n\n * Locate control system networks and remote devices behind firewalls, and isolate them from the business network.\n\n * When remote access is required, use secure methods, such as Virtual \nPrivate Networks (VPNs), recognizing that VPNs may have vulnerabilities \nand should be updated to the most current version available. Also \nrecognize that VPN is only as secure as the connected devices.\n\n * Investigate the practicality of configuring and deploying an \nintrusion detection system (IDS) to log and monitor the control system \nnetwork, as well as adjacent networks.\n\n * Configure, activate, and test existing defenses, such as port \nsecurity and traffic logging, among other defensive strategies in the \nrecommended practices document listed below." } ], "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2014-0769", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01", "refsource": "MISC", "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2014-0760", "datePublished": "2014-04-25T01:00:00", "dateReserved": "2014-01-02T00:00:00", "dateUpdated": "2025-07-02T20:29:50.796Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2014-0769 (GCVE-0-2014-0769)
Vulnerability from cvelistv5
Vendor | Product | Version | ||
---|---|---|---|---|
► | Festo | CECX-X-C1 Modular Master Controller with CoDeSys |
Version: all |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T09:27:19.529Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "CECX-X-C1 Modular Master Controller with CoDeSys", "vendor": "Festo", "versions": [ { "status": "affected", "version": "all" } ] }, { "defaultStatus": "unaffected", "product": "CECX-X-M1 Modular Controller with CoDeSys and SoftMotion", "vendor": "Festo", "versions": [ { "status": "affected", "version": "all" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "K. Reid Wightman of IOActive, Inc. has identified vulnerabilities in Festo\u2019s CECX-X-C1 and CECX-X-M1 controllers." } ], "datePublic": "2014-04-24T06:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eThe Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.\u003c/p\u003e" } ], "value": "The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001." } ], "metrics": [ { "cvssV2_0": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-07-02T20:26:44.615Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01" } ], "source": { "advisory": "ICSA-14-084-01", "discovery": "EXTERNAL" }, "title": "Festo CECX-X-(C1/M1) Controller Improper Authentication", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eFesto has decided not to resolve these vulnerabilities, placing \ncritical infrastructure asset owners using this product at risk. This \nadvisory is being published to alert critical infrastructure asset \nowners of the risk of using this equipment, and to increase compensating\n security measures if possible.\u0026nbsp;Some of these compensating measures can be:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMinimize network exposure for all control system devices and/or \nsystems, and ensure that they are not accessible from the Internet.\u003c/li\u003e\n\u003cli\u003eLocate control system networks and remote devices behind firewalls, and isolate them from the business network.\u003c/li\u003e\n\u003cli\u003eWhen remote access is required, use secure methods, such as Virtual \nPrivate Networks (VPNs), recognizing that VPNs may have vulnerabilities \nand should be updated to the most current version available. Also \nrecognize that VPN is only as secure as the connected devices.\u003c/li\u003e\n\u003cli\u003eInvestigate the practicality of configuring and deploying an \nintrusion detection system (IDS) to log and monitor the control system \nnetwork, as well as adjacent networks.\u003c/li\u003e\n\u003cli\u003eConfigure, activate, and test existing defenses, such as port \nsecurity and traffic logging, among other defensive strategies in the \nrecommended practices document listed below.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cbr\u003e" } ], "value": "Festo has decided not to resolve these vulnerabilities, placing \ncritical infrastructure asset owners using this product at risk. This \nadvisory is being published to alert critical infrastructure asset \nowners of the risk of using this equipment, and to increase compensating\n security measures if possible.\u00a0Some of these compensating measures can be:\n\n\n\n * Minimize network exposure for all control system devices and/or \nsystems, and ensure that they are not accessible from the Internet.\n\n * Locate control system networks and remote devices behind firewalls, and isolate them from the business network.\n\n * When remote access is required, use secure methods, such as Virtual \nPrivate Networks (VPNs), recognizing that VPNs may have vulnerabilities \nand should be updated to the most current version available. Also \nrecognize that VPN is only as secure as the connected devices.\n\n * Investigate the practicality of configuring and deploying an \nintrusion detection system (IDS) to log and monitor the control system \nnetwork, as well as adjacent networks.\n\n * Configure, activate, and test existing defenses, such as port \nsecurity and traffic logging, among other defensive strategies in the \nrecommended practices document listed below." } ], "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2014-0769", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01", "refsource": "MISC", "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2014-0769", "datePublished": "2014-04-25T01:00:00", "dateReserved": "2014-01-02T00:00:00", "dateUpdated": "2025-07-02T20:26:44.615Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2014-125060 (GCVE-0-2014-125060)
Vulnerability from cvelistv5
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CWE-287 - Improper Authentication
► | URL | Tags | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T14:10:56.612Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vdb-entry", "technical-description", "x_transferred" ], "url": "https://vuldb.com/?id.217614" }, { "tags": [ "signature", "permissions-required", "x_transferred" ], "url": "https://vuldb.com/?ctiid.217614" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/holdennb/CollabCal/commit/b80f6d1893607c99e5113967592417d0fe310ce6" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "CollabCal", "vendor": "holdennb", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "credits": [ { "lang": "en", "type": "tool", "value": "VulDB GitHub Commit Analyzer" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch is identified as b80f6d1893607c99e5113967592417d0fe310ce6. It is recommended to apply a patch to fix this issue. VDB-217614 is the identifier assigned to this vulnerability." }, { "lang": "de", "value": "Es wurde eine Schwachstelle in holdennb CollabCal gefunden. Sie wurde als kritisch eingestuft. Betroffen hiervon ist die Funktion handleGet der Datei calenderServer.cpp. Dank Manipulation mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Patch wird als b80f6d1893607c99e5113967592417d0fe310ce6 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen." } ], "metrics": [ { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-10-20T06:27:39.390Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.217614" }, { "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.217614" }, { "tags": [ "patch" ], "url": "https://github.com/holdennb/CollabCal/commit/b80f6d1893607c99e5113967592417d0fe310ce6" } ], "timeline": [ { "lang": "en", "time": "2023-01-07T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2023-01-07T00:00:00.000Z", "value": "CVE reserved" }, { "lang": "en", "time": "2023-01-07T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2023-01-29T20:52:21.000Z", "value": "VulDB entry last update" } ], "title": "holdennb CollabCal calenderServer.cpp handleGet improper authentication" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2014-125060", "datePublished": "2023-01-07T12:44:59.019Z", "dateReserved": "2023-01-07T12:44:23.196Z", "dateUpdated": "2024-08-06T14:10:56.612Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2015-10083 (GCVE-0-2015-10083)
Vulnerability from cvelistv5
6.3 (Medium) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CWE-287 - Improper Authentication
► | URL | Tags | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
harrystech | Dynosaur-Rails |
Version: n/a |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T08:58:26.288Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vdb-entry", "technical-description", "x_transferred" ], "url": "https://vuldb.com/?id.221503" }, { "tags": [ "signature", "permissions-required", "x_transferred" ], "url": "https://vuldb.com/?ctiid.221503" }, { "tags": [ "issue-tracking", "x_transferred" ], "url": "https://github.com/harrystech/dynosaur-rails/pull/11" }, { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/harrystech/dynosaur-rails/commit/04b223813f0e336aab50bff140d0f5889c31dbec" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Dynosaur-Rails", "vendor": "harrystech", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "credits": [ { "lang": "en", "type": "tool", "value": "VulDB GitHub Commit Analyzer" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper authentication. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 04b223813f0e336aab50bff140d0f5889c31dbec. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221503." }, { "lang": "de", "value": "In harrystech Dynosaur-Rails wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Dabei geht es um die Funktion basic_auth der Datei app/controllers/application_controller.rb. Durch das Manipulieren mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verf\u00fcgbar. Der Patch wird als 04b223813f0e336aab50bff140d0f5889c31dbec bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen." } ], "metrics": [ { "cvssV3_1": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 5.8, "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-10-20T09:00:05.926Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.221503" }, { "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.221503" }, { "tags": [ "issue-tracking" ], "url": "https://github.com/harrystech/dynosaur-rails/pull/11" }, { "tags": [ "patch" ], "url": "https://github.com/harrystech/dynosaur-rails/commit/04b223813f0e336aab50bff140d0f5889c31dbec" } ], "timeline": [ { "lang": "en", "time": "2023-02-19T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2023-02-19T00:00:00.000Z", "value": "CVE reserved" }, { "lang": "en", "time": "2023-02-19T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2023-03-23T11:55:29.000Z", "value": "VulDB entry last update" } ], "title": "harrystech Dynosaur-Rails application_controller.rb basic_auth improper authentication" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2015-10083", "datePublished": "2023-02-21T15:00:05.553Z", "dateReserved": "2023-02-19T19:39:31.610Z", "dateUpdated": "2024-08-06T08:58:26.288Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Mitigation
Phase: Architecture and Design
Strategy: Libraries or Frameworks
Description:
- Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.