CVE-2017-14728

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.orpak.com/allproducts/siteomat-station-controller-sw/	Product Vendor Advisory
http://www.securityfocus.com/bid/108167	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01	Third Party Advisory US Government Resource
http://www.orpak.com/allproducts/siteomat-station-controller-sw/	Product Vendor Advisory
http://www.securityfocus.com/bid/108167	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:orpak:siteomat:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-06-03 19:29

Updated : 2024-11-21 03:13

NVD link : CVE-2017-14728

Mitre link : CVE-2017-14728

CVE.ORG link : CVE-2017-14728

JSON object : View

Products Affected

orpak

siteomat

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2017-14728", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-06-03T19:29:00.220", "references": [{"url": "http://www.orpak.com/allproducts/siteomat-station-controller-sw/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/108167", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.orpak.com/allproducts/siteomat-station-controller-sw/", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/108167", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public."}, {"lang": "es", "value": "Se encontr\u00f3 una omisi\u00f3n de autenticaci\u00f3n en un \u00e1rea desconocida del c\u00f3digo fuente de SiteOmat. Todas las versiones de SiteOmat BOS se ven afectadas, antes de enviar este exploit. Adem\u00e1s, SiteOmat no obliga a los administradores a cambiar las contrase\u00f1as, dejando la autenticaci\u00f3n remota de SSH y HTTP abierta al p\u00fablico."}], "lastModified": "2024-11-21T03:13:24.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:orpak:siteomat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF41A56A-914A-4D8D-A310-AED1BC1CE9BA", "versionEndExcluding": "6.4.414.084"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}