Lucene search

IcscertCVE-2017-9632

HistoryAug 07, 2017 - 8:29 a.m.

CVE-2017-9632

2017-08-0708:29:00

CWE-311

icscert

web.nvd.nist.gov

cve-2017-9632

encryption

sensitive data

pdq manufacturing

laserwash

protouch

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

50.0%

JSON

A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The username and password are transmitted insecurely.

Affected configurations

Nvd

Node

pdqinclaserwash_g5_firmwareMatch-

AND

pdqinclaserwash_g5Match-

Node

pdqinclaserwash_g5_s_firmwareMatch-

AND

pdqinclaserwash_g5_sMatch-

Node

pdqinclaserwash_m5_firmwareMatch-

AND

pdqinclaserwash_m5Match-

Node

pdqinclaserwash_360_firmwareMatch-

AND

pdqinclaserwash_360Match-

Node

pdqinclaserwash_360_plus_firmwareMatch-

AND

pdqinclaserwash_360_plusMatch-

Node

pdqinclaserwash_autoxpress_firmwareMatch-

AND

pdqinclaserwash_autoxpressMatch-

Node

pdqinclaserwash_autoxpress_plus_firmwareMatch-

AND

pdqinclaserwash_autoxpress_plusMatch-

Node

pdqinclaserjet_firmwareMatch-

AND

pdqinclaserjetMatch-

Node

pdqincprotouch_tandem_firmwareMatch-

AND

pdqincprotouch_tandemMatch-

Node

pdqincprotouch_icon_firmwareMatch-

AND

pdqincprotouch_iconMatch-

Node

pdqincprotouch_autogloss_firmwareMatch-

AND

pdqincprotouch_autoglossMatch-

VendorProductVersionCPE
pdqinclaserwash_g5_firmware-cpe:2.3:o:pdqinc:laserwash_g5_firmware:-:*:*:*:*:*:*:*
pdqinclaserwash_g5-cpe:2.3:h:pdqinc:laserwash_g5:-:*:*:*:*:*:*:*
pdqinclaserwash_g5_s_firmware-cpe:2.3:o:pdqinc:laserwash_g5_s_firmware:-:*:*:*:*:*:*:*
pdqinclaserwash_g5_s-cpe:2.3:h:pdqinc:laserwash_g5_s:-:*:*:*:*:*:*:*
pdqinclaserwash_m5_firmware-cpe:2.3:o:pdqinc:laserwash_m5_firmware:-:*:*:*:*:*:*:*
pdqinclaserwash_m5-cpe:2.3:h:pdqinc:laserwash_m5:-:*:*:*:*:*:*:*
pdqinclaserwash_360_firmware-cpe:2.3:o:pdqinc:laserwash_360_firmware:-:*:*:*:*:*:*:*
pdqinclaserwash_360-cpe:2.3:h:pdqinc:laserwash_360:-:*:*:*:*:*:*:*
pdqinclaserwash_360_plus_firmware-cpe:2.3:o:pdqinc:laserwash_360_plus_firmware:-:*:*:*:*:*:*:*
pdqinclaserwash_360_plus-cpe:2.3:h:pdqinc:laserwash_360_plus:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pdqinc	laserwash_g5_firmware	-	cpe:2.3:o:pdqinc:laserwash_g5_firmware:-:::::::*
pdqinc	laserwash_g5	-	cpe:2.3:h:pdqinc:laserwash_g5:-:::::::*
pdqinc	laserwash_g5_s_firmware	-	cpe:2.3:o:pdqinc:laserwash_g5_s_firmware:-:::::::*
pdqinc	laserwash_g5_s	-	cpe:2.3:h:pdqinc:laserwash_g5_s:-:::::::*
pdqinc	laserwash_m5_firmware	-	cpe:2.3:o:pdqinc:laserwash_m5_firmware:-:::::::*
pdqinc	laserwash_m5	-	cpe:2.3:h:pdqinc:laserwash_m5:-:::::::*
pdqinc	laserwash_360_firmware	-	cpe:2.3:o:pdqinc:laserwash_360_firmware:-:::::::*
pdqinc	laserwash_360	-	cpe:2.3:h:pdqinc:laserwash_360:-:::::::*
pdqinc	laserwash_360_plus_firmware	-	cpe:2.3:o:pdqinc:laserwash_360_plus_firmware:-:::::::*
pdqinc	laserwash_360_plus	-	cpe:2.3:h:pdqinc:laserwash_360_plus:-:::::::*

Rows per page:

1-10 of 221

CNA Affected

[
  {
    "product": "PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch"
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSA-17-208-03

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

50.0%

JSON

Related for CVE-2017-9632