CVE-2017-7928

Опубликовано: 07 авг. 2017

Источник: nvd

CVSS3: 10

CVSS2: 7.5

EPSS Низкий

Описание

An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may allow for unauthorized communications to downstream devices.

Ссылки

http://www.securityfocus.com/bid/99536
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-192-06
Mitigation
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/99536
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-192-06
Mitigation
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:selinc:sel-3620_firmware:r202:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3620_firmware:r203:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3620_firmware:r203-v:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3620_firmware:r203-v1:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3620_firmware:r204:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3620_firmware:r204-v1:*:*:*:*:*:*:*

cpe:2.3:h:selinc:sel-3620:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

Одно из

cpe:2.3:o:selinc:sel-3622_firmware:r202:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3622_firmware:r203:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3622_firmware:r203-v:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3622_firmware:r203-v1:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3622_firmware:r204:*:*:*:*:*:*:*

cpe:2.3:o:selinc:sel-3622_firmware:r204-v1:*:*:*:*:*:*:*

cpe:2.3:h:selinc:sel-3622:-:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00525

Низкий

10 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-284

NVD-CWE-noinfo

Связанные уязвимости

GHSA-g89g-4g7j-cgmm