CVE-2011-2963

TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.exploit-db.com/exploits/17034	Exploit
http://www.osvdb.org/72888
http://www.securityfocus.com/bid/46907	Exploit
http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01.pdf	Patch US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01A.pdf	Patch US Government Resource
http://www.exploit-db.com/exploits/17034	Exploit
http://www.osvdb.org/72888
http://www.securityfocus.com/bid/46907	Exploit
http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01.pdf	Patch US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01A.pdf	Patch US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:progea:movicon:11.2:*:*:*:*:*:*:*

History

21 Nov 2024, 01:29

Type	Values Removed	Values Added
References	~~() http://www.exploit-db.com/exploits/17034 - Exploit~~	() http://www.exploit-db.com/exploits/17034 - Exploit
References	~~() http://www.osvdb.org/72888 -~~	() http://www.osvdb.org/72888 -
References	~~() http://www.securityfocus.com/bid/46907 - Exploit~~	() http://www.securityfocus.com/bid/46907 - Exploit
References	~~() http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01.pdf - Patch, US Government Resource~~	() http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01.pdf - Patch, US Government Resource
References	~~() http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01A.pdf - Patch, US Government Resource~~	() http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01A.pdf - Patch, US Government Resource

Information

Published : 2011-07-29 19:55

Updated : 2024-11-21 01:29

NVD link : CVE-2011-2963

Mitre link : CVE-2011-2963

CVE.ORG link : CVE-2011-2963

JSON object : View

Products Affected

progea

movicon

CWE

CWE-287

Improper Authentication

{"id": "CVE-2011-2963", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-07-29T19:55:04.437", "references": [{"url": "http://www.exploit-db.com/exploits/17034", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/72888", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/46907", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01.pdf", "tags": ["Patch", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01A.pdf", "tags": ["Patch", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.exploit-db.com/exploits/17034", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/72888", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/46907", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01.pdf", "tags": ["Patch", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-056-01A.pdf", "tags": ["Patch", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651."}, {"lang": "es", "value": "TCPUploadServer.exe en Progea Movicon v11.2 antes de Build1084 no requiere autenticaci\u00f3n para funciones cr\u00edticas, lo que permite a atacantes remotos obtener informaci\u00f3n sensible, borrar archivos, ejecutar programas de su elecci\u00f3n o causar una denegaci\u00f3n de servicio (ca\u00edda de la aplicaci\u00f3n) mediante un paquete debidamente modificado contra el puerto TCP 10651."}], "lastModified": "2024-11-21T01:29:22.730", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progea:movicon:11.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F069B966-A2DB-46A4-AC2A-A5E1628B5678"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}