PT-2013-1700 · Tridium · Tridium Niagara Ax

Name of the Vulnerable Software and Affected Versions: Tridium Niagara AX versions 3.5 through 3.7 Description: The issue allows remote attackers to read sensitive files and potentially execute arbitrary code by leveraging valid credentials or the guest feature. Recommendations: For versions 3.5...

Vulnerability Patched in Schneider Electric ICS Gear

The Industrial Control System CERT released an advisory this week warning of a vulnerability in a popular sensor monitoring system used in a number of critical industries, including energy, water and manufacturing. Aaron Portnoy of Exodus Intelligence discovered the flaw in the Windows-based...

SCADA, ICS Bug Brokering Mirrors IT Vulnerability Market

SAN JUAN, Puerto Rico – The world of SCADA and industrial control system vulnerabilities is starting to mirror that of IT security, not only in the demonstration and exploitation of zero-day vulnerabilities, but in the brokering of flaws and exploits between hackers and organizations interested i...

FBI Memo Shows Hackers Accessed Commercial HVAC Systems

An FBI memo says cyber intruders took advantage of weak credentialing in an industrial control system to gain control of a New Jersey air conditioning company’s heating, ventilation and air conditioning units. The cyber alert was issued July 23, 2012 but did not come to light until being posted...

CVE-2012-3025

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-3024

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...

Default configuration

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network...

Authentication flaw

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...

CVE-2012-3025

The vulnerability CVE-2012-3025 affects Tridium Niagara AX Framework (versions prior to 3.7). The root cause is a default configuration that transmits credentials in cookies using cleartext base64, enabling remote attackers to capture sensitive information by sniffing network traffic. Impact is c...

CVE-2012-3024

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...

CVE-2012-3024

CVE-2012-3024 affects Tridium Niagara AX Framework up to version 3.6. The issue is that session IDs and keys are predictable, potentially enabling remote attackers to bypass authentication through brute-force attempts. The description consistently states an authentication bypass risk but does not...

CVE-2012-3025

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network...

PT-2012-4446 · Tridium · Tridium Niagara Ax Framework

Name of the Vulnerable Software and Affected Versions: Tridium Niagara AX Framework versions prior to 3.7 Description: The issue concerns the default configuration of the software, which uses a cleartext base64 format for transmitting credentials in cookies. This allows remote attackers to obtain...

ICS-CERT Warns of Serious Flaws in Tridium Niagara Software

The DHS and ICS-CERT are warning users of some popular Tridium Niagara AX industrial control system software about a series of major vulnerabilities in the applications that are remotely exploitable and could be used to take over vulnerable systems. The bugs, discovered by researchers Billy Rios...

Tridium Niagara Web Server Detection

Binary data 6537.prm...

CVE-2012-4028

Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication...

CVE-2012-4027

Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file...

Authentication flaw

Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication...

Directory traversal

Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file...

CVE-2012-4028

CVE-2012-4028 affects the Tridium Niagara AX Framework. The vulnerability stems from improper storage of credential data, enabling context-dependent attackers to bypass authentication by using stored credentials. The NVD entry lists a high impact with network reach and low attack complexity, but ...