CVE-2017-5145

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.

CVSS v3 10.0 CRITICAL
CVSS v2.0 7.5 HIGH

10.0^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/95411	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:carlosgavazzi:vmu-c_em_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:carlosgavazzi:vmu-c_em:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:carlosgavazzi:vmu-c_pv_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:carlosgavazzi:vmu-c_pv:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-02-13 21:59

Updated : 2023-12-10 12:01

NVD link : CVE-2017-5145

Mitre link : CVE-2017-5145

CVE.ORG link : CVE-2017-5145

JSON object : View

Products Affected

carlosgavazzi

vmu-c_pv_firmware
vmu-c_em
vmu-c_em_firmware
vmu-c_pv

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2017-5145", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2017-02-13T21:59:02.550", "references": [{"url": "http://www.securityfocus.com/bid/95411", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration."}, {"lang": "es", "value": "Se ha descubierto un problema en Carlo Gavazzi VMU-C EM anterior a la versi\u00f3n de firmware A11_U05 y VMU-C PV anterior al firmware Versi\u00f3n A17. La explotaci\u00f3n exitosa de esta vulnerabilidad de CSRF puede permitir la ejecuci\u00f3n de acciones no autorizadas en el dispositivo, tales como cambios de par\u00e1metro de configuraci\u00f3n y guardado de configuraci\u00f3n modificada."}], "lastModified": "2017-02-24T13:29:19.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:carlosgavazzi:vmu-c_em_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87350035-E65E-4A46-8572-8039A6266D1D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:carlosgavazzi:vmu-c_em:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D57DACE2-2D99-4952-B15C-3E106886ABD3"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:carlosgavazzi:vmu-c_pv_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43AB7FE5-E55D-4096-9DA3-241299899FEF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:carlosgavazzi:vmu-c_pv:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E1E6B643-2FBD-4C8B-A498-8D0BD071505B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}