CVE-2022-29953

Опубликовано: 26 июл. 2022

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.

Ссылки

https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02
Mitigation
Third Party Advisory
US Government Resource
https://www.forescout.com/blog/
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02
Mitigation
Third Party Advisory
US Government Resource
https://www.forescout.com/blog/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_3701\/40_firmware:*:*:*:*:*:*:*:*

Версия до 4.1 (исключая)

cpe:2.3:h:bakerhughes:bently_nevada_3701\/40:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_3701\/44_firmware:*:*:*:*:*:*:*:*

Версия до 4.1 (исключая)

cpe:2.3:h:bakerhughes:bently_nevada_3701\/44:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_3701\/46_firmware:*:*:*:*:*:*:*:*

Версия до 4.1 (исключая)

cpe:2.3:h:bakerhughes:bently_nevada_3701\/46:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_60m100_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:bakerhughes:bently_nevada_60m100:-:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00402

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-798

Связанные уязвимости

GHSA-q25f-hc6j-2jpw

CVSS3: 9.8

github

больше 3 лет назад

EPSS

Процентиль: 60%

0.00402

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-798