Lucene search

IcscertCVE-2017-7920

HistoryAug 07, 2017 - 8:29 a.m.

CVE-2017-7920

2017-08-0708:29:00

CWE-287

icscert

web.nvd.nist.gov

cve-2017-7920

improper authentication

abb vsn300

wifi logger card

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

52.7%

JSON

An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access internal information about status and connected devices without authenticating.

Affected configurations

Nvd

Node

abbvsn300Match-

AND

abbvsn300_firmwareRange≤1.8.15

Node

abbvsn300_for_react_firmwareMatch2.1.3

AND

abbvsn300_for_reactMatch-

VendorProductVersionCPE
abbvsn300-cpe:2.3:h:abb:vsn300:-:*:*:*:*:*:*:*
abbvsn300_firmware*cpe:2.3:o:abb:vsn300_firmware:*:*:*:*:*:*:*:*
abbvsn300_for_react_firmware2.1.3cpe:2.3:o:abb:vsn300_for_react_firmware:2.1.3:*:*:*:*:*:*:*
abbvsn300_for_react-cpe:2.3:h:abb:vsn300_for_react:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
abb	vsn300	-	cpe:2.3:h:abb:vsn300:-:::::::*
abb	vsn300_firmware	*	cpe:2.3:o:abb:vsn300_firmware::::::::
abb	vsn300_for_react_firmware	2.1.3	cpe:2.3:o:abb:vsn300_for_react_firmware:2.1.3:::::::*
abb	vsn300_for_react	-	cpe:2.3:h:abb:vsn300_for_react:-:::::::*

CNA Affected

[
  {
    "product": "ABB VSN300 WiFi Logger Card",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "ABB VSN300 WiFi Logger Card"
      }
    ]
  }
]

References

search.abb.com/library/Download.aspx?DocumentID=9AKK107045A1977&LanguageCode=en&DocumentPartId=&Action=Launch

www.securityfocus.com/bid/99558

ics-cert.us-cert.gov/advisories/ICSA-17-192-03

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

52.7%

JSON

Related for CVE-2017-7920