CVE-2017-9664

In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which refers to files using ../../ relative paths. Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization.

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/100260	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-222-05	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:abb:srea-50_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:srea-50:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:abb:srea-01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:srea-01:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-05-24 20:29

Updated : 2023-12-10 12:30

NVD link : CVE-2017-9664

Mitre link : CVE-2017-9664

CVE.ORG link : CVE-2017-9664

JSON object : View

Products Affected

abb

srea-50
srea-01_firmware
srea-01
srea-50_firmware

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-23

Relative Path Traversal

{"id": "CVE-2017-9664", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-05-24T20:29:00.257", "references": [{"url": "http://www.securityfocus.com/bid/100260", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-222-05", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which refers to files using ../../ relative paths. Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization."}, {"lang": "es", "value": "En ABB SREA-01 revisiones A, B, C: en versiones de la aplicaci\u00f3n hasta la 3.31.5 y en SREA-50 revisi\u00f3n A: en versiones de la aplicaci\u00f3n hasta la 3.32.8, un atacante podr\u00eda acceder a archivos internos de las herramientas de monitorizaci\u00f3n antiguas remotas de ABB SREA-01 y SREA-50 sin autorizaci\u00f3n a trav\u00e9s de la red mediante una petici\u00f3n HTTP que se refiere a los archivos que emplean rutas ../../ relativas. Una vez que se recupera el archivo interno de contrase\u00f1as, el hash de la contrase\u00f1a se puede identificar mediante un ataque de fuerza bruta. Tambi\u00e9n hay un exploit que permite ejecutar comandos tras la autorizaci\u00f3n."}], "lastModified": "2019-10-09T23:30:47.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:srea-50_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DF23E98-6E25-4D94-925E-E836C7D706B4", "versionEndIncluding": "3.32.8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:srea-50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "52210FA9-8C19-4717-9C1E-CD2ADF4BD540"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:srea-01_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EF6D274-B243-4246-802C-8A90DF57176A", "versionEndIncluding": "3.31.5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:srea-01:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A677B3B0-7EAF-44AE-B75E-119E8EB72496"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}