{"containers": {"cna": {"affected": [{"product": "ABB SREA-01 and SREA-50", "vendor": "ICS-CERT", "versions": [{"status": "affected", "version": "SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8."}]}], "datePublic": "2018-05-24T00:00:00", "descriptions": [{"lang": "en", "value": "In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which refers to files using ../../ relative paths. Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "Relative path traversal CWE-23", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-05-25T09:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"name": "100260", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100260"}, {"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-222-05"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2018-05-24T00:00:00", "ID": "CVE-2017-9664", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ABB SREA-01 and SREA-50", "version": {"version_data": [{"version_value": "SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8."}]}}]}, "vendor_name": "ICS-CERT"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which refers to files using ../../ relative paths. Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Relative path traversal CWE-23"}]}]}, "references": {"reference_data": [{"name": "100260", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100260"}, {"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-222-05", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-222-05"}]}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2017-9664", "datePublished": "2018-05-24T00:00:00", "dateReserved": "2017-06-14T00:00:00", "dateUpdated": "2018-05-25T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:srea-50_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1DF23E98-6E25-4D94-925E-E836C7D706B4", "versionEndIncluding": "3.32.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:srea-50:-:*:*:*:*:*:*:*", "matchCriteriaId": "52210FA9-8C19-4717-9C1E-CD2ADF4BD540", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:srea-01_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4EF6D274-B243-4246-802C-8A90DF57176A", "versionEndIncluding": "3.31.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:srea-01:-:*:*:*:*:*:*:*", "matchCriteriaId": "A677B3B0-7EAF-44AE-B75E-119E8EB72496", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which refers to files using ../../ relative paths. Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization."}, {"lang": "es", "value": "En ABB SREA-01 revisiones A, B, C: en versiones de la aplicaci\u00f3n hasta la 3.31.5 y en SREA-50 revisi\u00f3n A: en versiones de la aplicaci\u00f3n hasta la 3.32.8, un atacante podr\u00eda acceder a archivos internos de las herramientas de monitorizaci\u00f3n antiguas remotas de ABB SREA-01 y SREA-50 sin autorizaci\u00f3n a trav\u00e9s de la red mediante una petici\u00f3n HTTP que se refiere a los archivos que emplean rutas ../../ relativas. Una vez que se recupera el archivo interno de contrase\u00f1as, el hash de la contrase\u00f1a se puede identificar mediante un ataque de fuerza bruta. Tambi\u00e9n hay un exploit que permite ejecutar comandos tras la autorizaci\u00f3n."}], "id": "CVE-2017-9664", "lastModified": "2019-10-09T23:30:47.580", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-05-24T20:29:00.257", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100260"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-222-05"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-23"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}