CVE-2017-7912

Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gain access to the device management page with admin privileges without proper authentication.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://ics-cert.us-cert.gov/advisories/ICSA-17-136-03	Third Party Advisory US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-17-136-03	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hanwhasecurity:srn-4000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hanwhasecurity:srn-4000:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:32

Type	Values Removed	Values Added
References	~~() https://ics-cert.us-cert.gov/advisories/ICSA-17-136-03 - US Government Resource, Third Party Advisory~~	() https://ics-cert.us-cert.gov/advisories/ICSA-17-136-03 - Third Party Advisory, US Government Resource

Information

Published : 2019-04-08 15:29

Updated : 2024-11-21 03:32

NVD link : CVE-2017-7912

Mitre link : CVE-2017-7912

CVE.ORG link : CVE-2017-7912

JSON object : View

Products Affected

hanwhasecurity

srn-4000_firmware
srn-4000

CWE

CWE-284

Improper Access Control

CWE-287

Improper Authentication

{"id": "CVE-2017-7912", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-04-08T15:29:00.263", "references": [{"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-136-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-136-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gain access to the device management page with admin privileges without proper authentication."}, {"lang": "es", "value": "Hanwha Techwin SRN-4000, versiones de firmware SRN-4000 anteriores a SRN4000_v2.16_170401, una petici\u00f3n y respuesta http especialmente creada podr\u00eda permitir a un atacante obtener acceso a la p\u00e1gina de administraci\u00f3n de dispositivos con privilegios de administrador sin la autenticaci\u00f3n apropiada."}], "lastModified": "2024-11-21T03:32:56.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hanwhasecurity:srn-4000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5657519-9C53-44A6-8A0F-46FCE0415E64", "versionEndExcluding": "2.16_170401"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hanwhasecurity:srn-4000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DCA6FB1B-0993-4FA9-A989-CD44C1ED9DFB"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}