Lucene search

IcscertCVE-2019-18253

HistoryNov 27, 2019 - 11:15 p.m.

CVE-2019-18253

2019-11-2723:15:10

CWE-22

icscert

web.nvd.nist.gov

cve-2019-18253

attacker

crafted paths

read

delete

files

relion 670 series

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.003

Percentile

65.2%

JSON

An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.

Affected configurations

Nvd

Node

hitachienergyrelion_670_firmwareRange<1p1r26

hitachienergyrelion_670_firmwareRange1.2–1.2.3.17

hitachienergyrelion_670_firmwareRange2.0–2.0.0.10

hitachienergyrelion_670_firmwareRange2.1–2.1.0.1

AND

hitachienergyrelion_670Match-

VendorProductVersionCPE
hitachienergyrelion_670_firmware*cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:*
hitachienergyrelion_670-cpe:2.3:h:hitachienergy:relion_670:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hitachienergy	relion_670_firmware	*	cpe:2.3:o:hitachienergy:relion_670_firmware::::::::
hitachienergy	relion_670	-	cpe:2.3:h:hitachienergy:relion_670:-:::::::*

CNA Affected

[
  {
    "product": "Relion 670 Series",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-19-330-01

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.003

Percentile

65.2%

JSON

Related for CVE-2019-18253