Tridium Niagara AX Web Server Directory Traversal 'config.bog' Disclosure Remote Compromise

Binary data scadatridiumniagarapatch11feb2013.nbin...

Tridium Niagara AX Detection

Binary data 6847.prm...

CVE-2012-4701

Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging 1 valid credentials or 2 the guest feature...

Directory traversal

Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging 1 valid credentials or 2 the guest feature...

CVE-2012-4701

CVE-2012-4701 describes a directory traversal in Tridium Niagara AX (versions 3.5–3.7) that lets a remote attacker read sensitive files and potentially execute arbitrary code. The vulnerability can be triggered when valid credentials are present or when the guest feature is enabled, enabling unau...

PT-2013-1700 · Tridium · Tridium Niagara Ax

Name of the Vulnerable Software and Affected Versions: Tridium Niagara AX versions 3.5 through 3.7 Description: The issue allows remote attackers to read sensitive files and potentially execute arbitrary code by leveraging valid credentials or the guest feature. Recommendations: For versions 3.5...

CVE-2012-3024

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...

CVE-2012-3025

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network...

Authentication flaw

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...

Default configuration

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-3024

CVE-2012-3024 affects Tridium Niagara AX Framework up to version 3.6. The issue is that session IDs and keys are predictable, potentially enabling remote attackers to bypass authentication through brute-force attempts. The description consistently states an authentication bypass risk but does not...

CVE-2012-3024

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...

CVE-2012-3025

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-3025

The vulnerability CVE-2012-3025 affects Tridium Niagara AX Framework (versions prior to 3.7). The root cause is a default configuration that transmits credentials in cookies using cleartext base64, enabling remote attackers to capture sensitive information by sniffing network traffic. Impact is c...

PT-2012-4445 · Tridium · Tridium Niagara Ax Framework

Name of the Vulnerable Software and Affected Versions: Tridium Niagara AX Framework versions prior to 3.8 is not mentioned, however, it is mentioned that versions through 3.6 are affected. Therefore: Tridium Niagara AX Framework versions through 3.6 Description: The issue is related to the use of...

ICS-CERT Warns of Serious Flaws in Tridium Niagara Software

The DHS and ICS-CERT are warning users of some popular Tridium Niagara AX industrial control system software about a series of major vulnerabilities in the applications that are remotely exploitable and could be used to take over vulnerable systems. The bugs, discovered by researchers Billy Rios...

CVE-2012-4028

Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication...

Authentication flaw

Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication...

Directory traversal

Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file...

CVE-2012-4027

CVE-2012-4027 concerns a directory traversal in the Tridium Niagara AX Framework . The vulnerability allows remote attackers to read files outside the intended images, nav, and px folders by exploiting incorrect permissions, with examples showing access to a file like config.bog . The connected s...