CVE-2020-7590

A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running software V4.4.0 are also affected by CVE-2020-15797). Affected devices use a hard-coded password to protect the onboard database. This could allow an attacker to read and or modify the onboard database. Successful exploitation requires direct physical access to the device.

CVSS v3 6.8 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.siemens-healthineers.com/support-documentation/security-advisory	Vendor Advisory
https://www.siemens-healthineers.com/support-documentation/security-advisory	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:siemens:dca_vantage_analyzer_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:dca_vantage_analyzer:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:37

Type	Values Removed	Values Added
References	~~() https://www.siemens-healthineers.com/support-documentation/security-advisory - Vendor Advisory~~	() https://www.siemens-healthineers.com/support-documentation/security-advisory - Vendor Advisory

Information

Published : 2020-10-13 16:15

Updated : 2024-11-21 05:37

NVD link : CVE-2020-7590

Mitre link : CVE-2020-7590

CVE.ORG link : CVE-2020-7590

JSON object : View

Products Affected

siemens

dca_vantage_analyzer_firmware
dca_vantage_analyzer

CWE

CWE-259

Use of Hard-coded Password

{"id": "CVE-2020-7590", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2020-10-13T16:15:21.780", "references": [{"url": "https://www.siemens-healthineers.com/support-documentation/security-advisory", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://www.siemens-healthineers.com/support-documentation/security-advisory", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-259"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running software V4.4.0 are also affected by CVE-2020-15797). Affected devices use a hard-coded password to protect the onboard database. This could allow an attacker to read and or modify the onboard database. Successful exploitation requires direct physical access to the device."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en DCA Vantage Analyzer (todas las versiones anteriores a V4.5 est\u00e1n afectadas por CVE-2020-7590. Adem\u00e1s, los n\u00fameros de serial anteriores a 40000 que ejecutan el software versi\u00f3n V4.4.0 tambi\u00e9n est\u00e1n afectadas por CVE-2020-15797). Los dispositivos afectados usan una contrase\u00f1a embebida para proteger la base de datos integrada. Esto podr\u00eda permitir a un atacante leer o modificar la base de datos integrada. Una explotaci\u00f3n con \u00e9xito requiere acceso f\u00edsico directo al dispositivo"}], "lastModified": "2024-11-21T05:37:25.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:dca_vantage_analyzer_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B4F34A3-AB7B-4528-9F27-3073E25A5176", "versionEndExcluding": "4.5.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:dca_vantage_analyzer:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EDE5221F-8629-4DC4-AD8A-93EED671469B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "productcert@siemens.com"}