CVE-2017-16748

Опубликовано: 20 авг. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system.

Ссылки

http://www.securityfocus.com/bid/105101
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03
Third Party Advisory
US Government Resource
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01
http://www.securityfocus.com/bid/105101
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03
Third Party Advisory
US Government Resource
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*

Версия до 4.4 (включая)

cpe:2.3:a:tridium:niagara_ax_framework:*:*:*:*:*:*:*:*

Версия до 3.8 (включая)

EPSS

Процентиль: 90%

0.05886

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-jwjj-j6r3-3643