CVE-2017-16726

{"id": "CVE-2017-16726", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2018-06-27T19:29:00.280", "references": [{"url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2017-001.pdf", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-326"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve security purposes and therefore does not include any encryption algorithms because of their negative effect on performance and throughput. An attacker can forge arbitrary ADS packets when legitimate ADS traffic is observable."}, {"lang": "es", "value": "Beckhoff TwinCAT soporta comunicaciones por ADS. ADS es un protocolo para la automatizaci\u00f3n industrial en entornos protegidos. ADS no se ha dise\u00f1ado desde el punto de vista de la seguridad y, por lo tanto, no incluye ning\u00fan algoritmo de cifrado por su efecto negativo en el rendimiento y el throughput. Un atacante podr\u00eda forjar paquetes ADS arbitrarios cuando es observable tr\u00e1fico ADS leg\u00edtimo."}], "lastModified": "2019-10-09T23:25:14.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:beckhoff:twincat:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0324B77D-8923-4C9B-8F06-535FBC758AF7"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}