Authentication flaw

2022-02-2419:15:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.2%

JSON

The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings.

CPENameOperatorVersion
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarege4.001
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarele4.005
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarege5.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmwarele5.017
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmwareeq6.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmwareeq6.012

Name	Operator	Version
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	ge	4.001
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	le	4.005
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	ge	5.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_b_firmware	le	5.017
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmware	eq	6.011
1734-aentr_point_i\\/o_dual_port_network_adaptor_series_c_firmware	eq	6.012

References

www.cisa.gov/uscert/ics/advisories/icsa-21-063-01