CVE-2014-8329

Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2014/Jul/40
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140710-2_Schrack_Technik_Microcontrol_Multiple_critical_vulnerabilities_v10.txt

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:schrack:technik_microcontrol_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schrack:technik_microcontrol:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2014-10-20 15:55

Updated : 2024-02-28 12:20

NVD link : CVE-2014-8329

Mitre link : CVE-2014-8329

CVE.ORG link : CVE-2014-8329

JSON object : View

Products Affected

schrack

technik_microcontrol_firmware
technik_microcontrol

CWE

CWE-287

Improper Authentication

{"id": "CVE-2014-8329", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-10-20T15:55:05.010", "references": [{"url": "http://seclists.org/fulldisclosure/2014/Jul/40", "source": "cve@mitre.org"}, {"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140710-2_Schrack_Technik_Microcontrol_Multiple_critical_vulnerabilities_v10.txt", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt."}, {"lang": "es", "value": "Schrack Technik microControl con firmware anterior a 1.7.0 (937) almacena informaci\u00f3n sensible bajo el root web con insuficiente control de acceso, lo que permite a atacantes remotos obtener datos de acceso para los servicios ftp y telnet a trav\u00e9s de una solicitud directa de ZTPUsrDtls.txt."}], "lastModified": "2014-10-23T00:02:08.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schrack:technik_microcontrol_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51174479-80AC-41BD-9663-4B363807F323", "versionEndIncluding": "1.7.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schrack:technik_microcontrol:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10C9BFEF-A52A-4869-ADB5-4D35E6680E0C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}