Описание
WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 perform authentication on the KAEClientManager console rather than on the server, which allows remote attackers to bypass intended access restrictions and discover credentials via a crafted packet to TCP port 8130.
Ссылки
- PatchUS Government Resource
- PatchUS Government Resource
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.2 (включая)Версия до 3.1 (включая)Версия до 3.1 (включая)
Одно из
cpe:2.3:a:wellintech:kingalarm\&event:*:*:*:*:*:*:*:*
cpe:2.3:a:wellintech:kinggraphic:*:*:*:*:*:*:*:*
cpe:2.3:a:wellintech:kingscada:*:*:*:*:*:*:*:*
EPSS
Процентиль: 50%
0.00272
Низкий
6.4 Medium
CVSS2
Дефекты
CWE-264
Связанные уязвимости
github
больше 3 лет назад
WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 perform authentication on the KAEClientManager console rather than on the server, which allows remote attackers to bypass intended access restrictions and discover credentials via a crafted packet to TCP port 8130.
EPSS
Процентиль: 50%
0.00272
Низкий
6.4 Medium
CVSS2
Дефекты
CWE-264