Lucene search

IcscertCVE-2017-5169

HistoryFeb 13, 2017 - 9:59 p.m.

CVE-2017-5169

2017-02-1321:59:03

CWE-352

icscert

web.nvd.nist.gov

hanwha techwin

smart security manager

cve-2017-5169

csrf

cross site request forgery

redis

apache felix gogo

remote code execution

security vulnerabilities

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Post requests, an attacker can gain system level access to a remote shell session. Smart Security Manager Versions 1.5 and prior are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.

Affected configurations

Nvd

Node

hanwha-securitysmart_security_managerRange≤1.5

VendorProductVersionCPE
hanwha-securitysmart_security_manager*cpe:2.3:a:hanwha-security:smart_security_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hanwha-security	smart_security_manager	*	cpe:2.3:a:hanwha-security:smart_security_manager::::::::

CNA Affected

[
  {
    "product": "Hanwha Techwin Smart Security Manager 1.5 and prior",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Hanwha Techwin Smart Security Manager 1.5 and prior"
      }
    ]
  }
]

References

www.securityfocus.com/bid/96147

ics-cert.us-cert.gov/advisories/ICSA-17-040-01

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

Related for CVE-2017-5169