Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveIcscertCVE-2021-32997
HistoryMay 25, 2022 - 2:15 p.m.

CVE-2021-32997

2022-05-2514:15:08
CWE-916
icscert
web.nvd.nist.gov
66
3
cve-2021-32997
baker hughes bentley nevada
weak encryption algorithm
sensitive data
credentials
information security
nvd

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

39.4%

JSON

The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01 versions 5.05 and prior) utilize a weak encryption algorithm for storage and transmission of sensitive data, which may allow an attacker to more easily obtain credentials used for access.

Affected configurations

Nvd
Node
bakerhughesbentley_nevada_3500_system_1_6.x_\(3060\/00\)_firmwareRange≤6.98
AND
bakerhughesbentley_nevada_3500_system_1_6.x_\(3060\/00\)Match-
Node
bakerhughesbentley_nevada_3500_system_1_\(3072\/xx\)_firmwareRange<21.1
OR
bakerhughesbentley_nevada_3500_system_1_\(3072\/xx\)_firmwareMatch21.1-
AND
bakerhughesbentley_nevada_3500_system_1_\(3072\/xx\)Match-
Node
bakerhughesbentley_nevada_3500_system_1_\(3071\/xx\)_firmwareRange<21.1
OR
bakerhughesbentley_nevada_3500_system_1_\(3071\/xx\)_firmwareMatch21.1-
AND
bakerhughesbentley_nevada_3500_system_1_\(3071\/xx\)Match-
Node
bakerhughesbentley_nevada_3500\/22m_\(288055-01\)_firmwareRange≤5.05
AND
bakerhughesbentley_nevada_3500\/22m_\(288055-01\)Match-
Node
bakerhughesbentley_nevada_3500_rack_configuration_\(129133-01\)_firmwareRange≤6.4
AND
bakerhughesbentley_nevada_3500_rack_configuration_\(129133-01\)Match-
VendorProductVersionCPE
bakerhughesbentley_nevada_3500_system_1_6.x_\(3060\/00\)_firmware*cpe:2.3:o:bakerhughes:bentley_nevada_3500_system_1_6.x_\(3060\/00\)_firmware:*:*:*:*:*:*:*:*
bakerhughesbentley_nevada_3500_system_1_6.x_\(3060\/00\)-cpe:2.3:h:bakerhughes:bentley_nevada_3500_system_1_6.x_\(3060\/00\):-:*:*:*:*:*:*:*
bakerhughesbentley_nevada_3500_system_1_\(3072\/xx\)_firmware*cpe:2.3:o:bakerhughes:bentley_nevada_3500_system_1_\(3072\/xx\)_firmware:*:*:*:*:*:*:*:*
bakerhughesbentley_nevada_3500_system_1_\(3072\/xx\)_firmware21.1cpe:2.3:o:bakerhughes:bentley_nevada_3500_system_1_\(3072\/xx\)_firmware:21.1:-:*:*:*:*:*:*
bakerhughesbentley_nevada_3500_system_1_\(3072\/xx\)-cpe:2.3:h:bakerhughes:bentley_nevada_3500_system_1_\(3072\/xx\):-:*:*:*:*:*:*:*
bakerhughesbentley_nevada_3500_system_1_\(3071\/xx\)_firmware*cpe:2.3:o:bakerhughes:bentley_nevada_3500_system_1_\(3071\/xx\)_firmware:*:*:*:*:*:*:*:*
bakerhughesbentley_nevada_3500_system_1_\(3071\/xx\)_firmware21.1cpe:2.3:o:bakerhughes:bentley_nevada_3500_system_1_\(3071\/xx\)_firmware:21.1:-:*:*:*:*:*:*
bakerhughesbentley_nevada_3500_system_1_\(3071\/xx\)-cpe:2.3:h:bakerhughes:bentley_nevada_3500_system_1_\(3071\/xx\):-:*:*:*:*:*:*:*
bakerhughesbentley_nevada_3500\/22m_\(288055-01\)_firmware*cpe:2.3:o:bakerhughes:bentley_nevada_3500\/22m_\(288055-01\)_firmware:*:*:*:*:*:*:*:*
bakerhughesbentley_nevada_3500\/22m_\(288055-01\)-cpe:2.3:h:bakerhughes:bentley_nevada_3500\/22m_\(288055-01\):-:*:*:*:*:*:*:*
Rows per page:
1-10 of 121

CNA Affected

[
  {
    "product": "3500 System 1 6.x, Part No. 3060/00",
    "vendor": "Bentley Nevada, a Baker Hughes subsidiary",
    "versions": [
      {
        "lessThanOrEqual": "6.98",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "3500 System 1, Part No. 3071/xx & 3072/xx",
    "vendor": "Bentley Nevada, a Baker Hughes subsidiary",
    "versions": [
      {
        "lessThanOrEqual": "21.1 HF1",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "3500 Rack Configuration, Part No. 129133-01",
    "vendor": "Bentley Nevada, a Baker Hughes subsidiary",
    "versions": [
      {
        "lessThanOrEqual": "6.4",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "3500/22M Firmware, Part No. 288055-01",
    "vendor": "Bentley Nevada, a Baker Hughes subsidiary",
    "versions": [
      {
        "lessThanOrEqual": "5.05",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

Social References

More

Related

nvd 1
prion 1
ics 1
cvelist 1
nvd
nvd
CVE-2021-32997
2022-05-25 14:15:08
prion
prion
Design/Logic Flaw
2022-05-25 14:15:00
ics
ics
Baker Hughes Bently Nevada 3500
2022-02-24 12:00:00
cvelist
cvelist
CVE-2021-32997 Baker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational Effort
2022-05-25 13:33:43

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

39.4%

JSON
Related for CVE-2021-32997
nvd1prion1ics1cvelist1