CWE-288
Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
CVE-2016-9497 (GCVE-0-2016-9497)
Vulnerability from cvelistv5
► | URL | Tags | ||||||
---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
► | Hughes Satellite Modem | HN7740S | ||
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T02:50:38.663Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "96244", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "https://www.securityfocus.com/bid/96244" }, { "name": "VU#614751", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "https://www.kb.cert.org/vuls/id/614751" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "HN7740S", "vendor": "Hughes Satellite Modem", "versions": [ { "status": "unknown", "version": "N/A" } ] }, { "product": "DW7000", "vendor": "Hughes Satellite Modem", "versions": [ { "status": "unknown", "version": "N/A" } ] }, { "product": "HN7000S/SM", "vendor": "Hughes Satellite Modem", "versions": [ { "status": "unknown", "version": "N/A" } ] } ], "datePublic": "2017-02-15T00:00:00", "descriptions": [ { "lang": "en", "value": "Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel. By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2018-07-13T19:57:01", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc" }, "references": [ { "name": "96244", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "https://www.securityfocus.com/bid/96244" }, { "name": "VU#614751", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "https://www.kb.cert.org/vuls/id/614751" } ], "source": { "discovery": "UNKNOWN" }, "title": "Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cert@cert.org", "ID": "CVE-2016-9497", "STATE": "PUBLIC", "TITLE": "Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "HN7740S", "version": { "version_data": [ { "affected": "?", "version_affected": "?", "version_value": "N/A" } ] } }, { "product_name": "DW7000", "version": { "version_data": [ { "affected": "?", "version_affected": "?", "version_value": "N/A" } ] } }, { "product_name": "HN7000S/SM", "version": { "version_data": [ { "affected": "?", "version_affected": "?", "version_value": "N/A" } ] } } ] }, "vendor_name": "Hughes Satellite Modem" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel. By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-288" } ] } ] }, "references": { "reference_data": [ { "name": "96244", "refsource": "BID", "url": "https://www.securityfocus.com/bid/96244" }, { "name": "VU#614751", "refsource": "CERT-VN", "url": "https://www.kb.cert.org/vuls/id/614751" } ] }, "source": { "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2016-9497", "datePublished": "2018-07-13T20:00:00", "dateReserved": "2016-11-21T00:00:00", "dateUpdated": "2024-08-06T02:50:38.663Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2017-5174 (GCVE-0-2017-5174)
Vulnerability from cvelistv5
► | URL | Tags | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
n/a | Geutebruck IP Cameras |
Version: Geutebruck IP Cameras |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T14:55:35.010Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "96209", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/96209" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02" }, { "name": "41360", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "url": "https://www.exploit-db.com/exploits/41360/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Geutebruck IP Cameras", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Geutebruck IP Cameras" } ] } ], "datePublic": "2017-05-18T00:00:00", "descriptions": [ { "lang": "en", "value": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2017-08-31T09:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "name": "96209", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/96209" }, { "tags": [ "x_refsource_MISC" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02" }, { "name": "41360", "tags": [ "exploit", "x_refsource_EXPLOIT-DB" ], "url": "https://www.exploit-db.com/exploits/41360/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2017-5174", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Geutebruck IP Cameras", "version": { "version_data": [ { "version_value": "Geutebruck IP Cameras" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-288" } ] } ] }, "references": { "reference_data": [ { "name": "96209", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96209" }, { "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02" }, { "name": "41360", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/41360/" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2017-5174", "datePublished": "2017-05-19T02:43:00", "dateReserved": "2017-01-03T00:00:00", "dateUpdated": "2024-08-05T14:55:35.010Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2017-6871 (GCVE-0-2017-6871)
Vulnerability from cvelistv5
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
► | URL | Tags | ||||||
---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
n/a | SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android |
Version: SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T15:41:17.693Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "99582", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/99582" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android", "vendor": "n/a", "versions": [ { "status": "affected", "version": "SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android" } ] } ], "datePublic": "2017-08-07T00:00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app\u0027s authentication mechanism under certain conditions." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2017-08-08T09:57:01", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "name": "99582", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/99582" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2017-6871", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android", "version": { "version_data": [ { "version_value": "SIMATIC WinCC Sm@rtClient for Android, SIMATIC WinCC Sm@rtClient Lite for Android" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app\u0027s authentication mechanism under certain conditions." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-288: Authentication Bypass Using an Alternate Path or Channel" } ] } ] }, "references": { "reference_data": [ { "name": "99582", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99582" }, { "name": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf", "refsource": "CONFIRM", "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2017-6871", "datePublished": "2017-08-08T00:00:00", "dateReserved": "2017-03-13T00:00:00", "dateUpdated": "2024-08-05T15:41:17.693Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2017-9944 (GCVE-0-2017-9944)
Vulnerability from cvelistv5
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
► | URL | Tags | ||||||
---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
n/a | Siemens 7KT PAC1200 data manager (7KT1260) All versions < V2.03 |
Version: Siemens 7KT PAC1200 data manager (7KT1260) All versions < V2.03 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T17:25:00.615Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-971654.pdf" }, { "name": "101184", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/101184" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Siemens 7KT PAC1200 data manager (7KT1260) All versions \u003c V2.03", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Siemens 7KT PAC1200 data manager (7KT1260) All versions \u003c V2.03" } ] } ], "datePublic": "2017-12-25T00:00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions \u003c V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations over the network." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2017-12-26T10:57:01", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-971654.pdf" }, { "name": "101184", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/101184" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2017-9944", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Siemens 7KT PAC1200 data manager (7KT1260) All versions \u003c V2.03", "version": { "version_data": [ { "version_value": "Siemens 7KT PAC1200 data manager (7KT1260) All versions \u003c V2.03" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions \u003c V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations over the network." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-288: Authentication Bypass Using an Alternate Path or Channel" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-971654.pdf", "refsource": "CONFIRM", "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-971654.pdf" }, { "name": "101184", "refsource": "BID", "url": "http://www.securityfocus.com/bid/101184" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2017-9944", "datePublished": "2017-12-26T04:00:00", "dateReserved": "2017-06-26T00:00:00", "dateUpdated": "2024-08-05T17:25:00.615Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2018-10841 (GCVE-0-2018-10841)
Vulnerability from cvelistv5
► | URL | Tags | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T07:46:47.063Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841" }, { "name": "RHSA-2018:1955", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2018:1955" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://review.gluster.org/#/c/20328/" }, { "name": "RHSA-2018:1954", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2018:1954" }, { "name": "GLSA-201904-06", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201904-06" }, { "name": "[debian-lts-announce] 20211101 [SECURITY] [DLA 2806-1] glusterfs security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "glusterfs", "vendor": "Red Hat", "versions": [ { "status": "affected", "version": "all" } ] } ], "datePublic": "2018-06-20T00:00:00", "descriptions": [ { "lang": "en", "value": "glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes." } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2021-11-02T02:06:37", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841" }, { "name": "RHSA-2018:1955", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2018:1955" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://review.gluster.org/#/c/20328/" }, { "name": "RHSA-2018:1954", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2018:1954" }, { "name": "GLSA-201904-06", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201904-06" }, { "name": "[debian-lts-announce] 20211101 [SECURITY] [DLA 2806-1] glusterfs security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html" } ] } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2018-10841", "datePublished": "2018-06-20T18:00:00", "dateReserved": "2018-05-09T00:00:00", "dateUpdated": "2024-08-05T07:46:47.063Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2018-17918 (GCVE-0-2018-17918)
Vulnerability from cvelistv5
- CWE-288 - AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL
► | URL | Tags | ||||||
---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
unknown | Circontrol CirCarLife all versions prior to 4.3.1 |
Version: Circontrol CirCarLife all versions prior to 4.3.1 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T11:01:14.680Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "105816", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/105816" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-305-03" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Circontrol CirCarLife all versions prior to 4.3.1", "vendor": "unknown", "versions": [ { "status": "affected", "version": "Circontrol CirCarLife all versions prior to 4.3.1" } ] } ], "datePublic": "2018-11-02T00:00:00", "descriptions": [ { "lang": "en", "value": "Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2018-11-06T10:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "name": "105816", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/105816" }, { "tags": [ "x_refsource_MISC" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-305-03" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2018-17918", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Circontrol CirCarLife all versions prior to 4.3.1", "version": { "version_data": [ { "version_value": "Circontrol CirCarLife all versions prior to 4.3.1" } ] } } ] }, "vendor_name": "unknown" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288" } ] } ] }, "references": { "reference_data": [ { "name": "105816", "refsource": "BID", "url": "http://www.securityfocus.com/bid/105816" }, { "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-305-03", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-305-03" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2018-17918", "datePublished": "2018-11-02T15:00:00", "dateReserved": "2018-10-02T00:00:00", "dateUpdated": "2024-08-05T11:01:14.680Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2018-19000 (GCVE-0-2018-19000)
Vulnerability from cvelistv5
- CWE-288 - AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL
► | URL | Tags | ||||||
---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
ICS-CERT | LCDS Laquis SCADA |
Version: All versions prior to version 4.1.0.4150 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T11:23:08.521Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01" }, { "name": "106634", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/106634" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "LCDS Laquis SCADA", "vendor": "ICS-CERT", "versions": [ { "status": "affected", "version": "All versions prior to version 4.1.0.4150" } ] } ], "datePublic": "2019-01-15T00:00:00", "descriptions": [ { "lang": "en", "value": "LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2019-02-06T10:57:02", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01" }, { "name": "106634", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/106634" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2019-01-15T00:00:00", "ID": "CVE-2018-19000", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "LCDS Laquis SCADA", "version": { "version_data": [ { "version_value": "All versions prior to version 4.1.0.4150" } ] } } ] }, "vendor_name": "ICS-CERT" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288" } ] } ] }, "references": { "reference_data": [ { "name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01" }, { "name": "106634", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106634" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2018-19000", "datePublished": "2019-02-05T18:00:00Z", "dateReserved": "2018-11-06T00:00:00", "dateUpdated": "2024-09-16T19:57:27.111Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2018-4852 (GCVE-0-2018-4852)
Vulnerability from cvelistv5
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
► | URL | Tags | ||||||
---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
Siemens AG | SICLOCK TC100, SICLOCK TC400 |
Version: SICLOCK TC100 : All versions Version: SICLOCK TC400 : All versions |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T05:18:26.602Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "104672", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/104672" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SICLOCK TC100, SICLOCK TC400", "vendor": "Siemens AG", "versions": [ { "status": "affected", "version": "SICLOCK TC100 : All versions" }, { "status": "affected", "version": "SICLOCK TC400 : All versions" } ] } ], "datePublic": "2018-07-03T00:00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could potentially circumvent the authentication mechanism if he/she is able to obtain certain knowledge specific to the attacked device." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2018-07-06T09:57:01", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "name": "104672", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/104672" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "DATE_PUBLIC": "2018-07-03T00:00:00", "ID": "CVE-2018-4852", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SICLOCK TC100, SICLOCK TC400", "version": { "version_data": [ { "version_value": "SICLOCK TC100 : All versions" }, { "version_value": "SICLOCK TC400 : All versions" } ] } } ] }, "vendor_name": "Siemens AG" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could potentially circumvent the authentication mechanism if he/she is able to obtain certain knowledge specific to the attacked device." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-288: Authentication Bypass Using an Alternate Path or Channel" } ] } ] }, "references": { "reference_data": [ { "name": "104672", "refsource": "BID", "url": "http://www.securityfocus.com/bid/104672" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2018-4852", "datePublished": "2018-07-03T14:00:00Z", "dateReserved": "2018-01-02T00:00:00", "dateUpdated": "2024-09-17T03:07:34.425Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2018-5386 (GCVE-0-2018-5386)
Vulnerability from cvelistv5
► | URL | Tags | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T05:33:44.404Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3" }, { "name": "103544", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/103544" }, { "name": "VU#184077", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "https://www.kb.cert.org/vuls/id/184077" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Infinity", "vendor": "Navarino", "versions": [ { "lessThan": "2.2", "status": "affected", "version": "2.2", "versionType": "custom" } ] } ], "datePublic": "2018-02-21T00:00:00", "descriptions": [ { "lang": "en", "value": "Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2018-07-25T09:57:01", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3" }, { "name": "103544", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/103544" }, { "name": "VU#184077", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "https://www.kb.cert.org/vuls/id/184077" } ], "source": { "discovery": "UNKNOWN" }, "title": "Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cert@cert.org", "ID": "CVE-2018-5386", "STATE": "PUBLIC", "TITLE": "Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Infinity", "version": { "version_data": [ { "affected": "\u003c", "version_affected": "\u003c", "version_name": "2.2", "version_value": "2.2" } ] } } ] }, "vendor_name": "Navarino" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-288" } ] } ] }, "references": { "reference_data": [ { "name": "https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html", "refsource": "MISC", "url": "https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html" }, { "name": "https://medium.com/@evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3", "refsource": "MISC", "url": "https://medium.com/@evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3" }, { "name": "103544", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103544" }, { "name": "VU#184077", "refsource": "CERT-VN", "url": "https://www.kb.cert.org/vuls/id/184077" } ] }, "source": { "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2018-5386", "datePublished": "2018-07-24T15:00:00", "dateReserved": "2018-01-12T00:00:00", "dateUpdated": "2024-08-05T05:33:44.404Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2018-8859 (GCVE-0-2018-8859)
Vulnerability from cvelistv5
- CWE-288 - AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL
► | URL | Tags | |||
---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
► | Echelon | SmartServer 1 |
Version: all versions |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T07:10:46.232Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SmartServer 1", "vendor": "Echelon", "versions": [ { "status": "affected", "version": "all versions" } ] }, { "product": "SmartServer 2", "vendor": "Echelon", "versions": [ { "status": "affected", "version": "all versions prior to release 4.11.007" } ] }, { "product": "i.LON 100", "vendor": "Echelon", "versions": [ { "status": "affected", "version": "all versions" } ] }, { "product": "i.LON 600", "vendor": "Echelon", "versions": [ { "status": "affected", "version": "all versions" } ] } ], "datePublic": "2018-07-19T00:00:00", "descriptions": [ { "lang": "en", "value": "Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2018-07-24T16:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2018-07-19T00:00:00", "ID": "CVE-2018-8859", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SmartServer 1", "version": { "version_data": [ { "version_value": "all versions" } ] } }, { "product_name": "SmartServer 2", "version": { "version_data": [ { "version_value": "all versions prior to release 4.11.007" } ] } }, { "product_name": "i.LON 100", "version": { "version_data": [ { "version_value": "all versions" } ] } }, { "product_name": "i.LON 600", "version": { "version_data": [ { "version_value": "all versions" } ] } } ] }, "vendor_name": "Echelon" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288" } ] } ] }, "references": { "reference_data": [ { "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03" } ] } } } }, "cveMetadata": { "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2018-8859", "datePublished": "2018-07-24T17:00:00Z", "dateReserved": "2018-03-20T00:00:00", "dateUpdated": "2024-09-17T03:48:36.377Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Mitigation
Phase: Architecture and Design
Description:
- Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.