CVE-2017-6871

Опубликовано: 08 авг. 2017

Источник: nvd

CVSS3: 5.4

CVSS2: 4.6

EPSS Низкий

Описание

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app's authentication mechanism under certain conditions.

Ссылки

http://www.securityfocus.com/bid/99582
Third Party Advisory
VDB Entry
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf
Vendor Advisory
http://www.securityfocus.com/bid/99582
Third Party Advisory
VDB Entry
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:simatic_wincc_sm\@rtclient:*:*:*:*:*:android:*:*

Версия до 1.0.2.1 (включая)

cpe:2.3:a:siemens:simatic_wincc_sm\@rtclient_lite:*:*:*:*:*:android:*:*

Версия до 1.0.2.1 (включая)

EPSS

Процентиль: 18%

0.00059

Низкий

5.4 Medium

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-288

CWE-287

Связанные уязвимости

GHSA-9fjf-27f3-w5w8