Details of VAR-200803-0395

ID

VAR-200803-0395

CVE

CVE-2008-1546

TITLE

Mitsubishi Electric GB-50A Java applet Remote bypass authentication vulnerability

Trust: 0.8

sources: IVD: 077962fc-23ce-11e6-abef-000c29c66e3d // CNNVD: CNNVD-200803-471

DESCRIPTION

servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command. The Mitsubishi Electric GB-50A is prone to multiple authentication-bypass vulnerabilities. Successful exploits will allow unauthorized attackers to gain access to administrative functionality and completely compromise vulnerable devices; other attacks are also possible

Trust: 2.07

sources: NVD: CVE-2008-1546 // JVNDB: JVNDB-2008-004278 // BID: 28406 // IVD: 077962fc-23ce-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.2

sources: IVD: 077962fc-23ce-11e6-abef-000c29c66e3d

AFFECTED PRODUCTS

vendor:	mitsubishi electric	model:	gb	scope:	eq	version:	50	Trust: 1.6
vendor:	mitsubishi electric	model:	gb	scope:	eq	version:	50a	Trust: 1.6
vendor:	mitsubishi electric	model:	gb	scope:	eq	version:	(gb-50)	Trust: 0.8
vendor:	mitsubishi electric	model:	gb	scope:	eq	version:	(gb-50a)	Trust: 0.8
vendor:	mitsubishi	model:	electric gb-50a	scope:	eq	version:	0	Trust: 0.3
vendor:	gb	model:	-	scope:	eq	version:	50	Trust: 0.2
vendor:	gb	model:	50a	scope:	-	version:	-	Trust: 0.2

sources: IVD: 077962fc-23ce-11e6-abef-000c29c66e3d // BID: 28406 // JVNDB: JVNDB-2008-004278 // CNNVD: CNNVD-200803-471 // NVD: CVE-2008-1546

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-1546
value:	HIGH
Trust: 1.0
NVD:	CVE-2008-1546
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200803-471
value:	HIGH
Trust: 0.6
IVD:	077962fc-23ce-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2008-1546
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
IVD:	077962fc-23ce-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 077962fc-23ce-11e6-abef-000c29c66e3d // JVNDB: JVNDB-2008-004278 // CNNVD: CNNVD-200803-471 // NVD: CVE-2008-1546

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-DesignError	Trust: 0.8

sources: JVNDB: JVNDB-2008-004278 // NVD: CVE-2008-1546

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200803-471

TYPE

Design error

Trust: 0.8

sources: IVD: 077962fc-23ce-11e6-abef-000c29c66e3d // CNNVD: CNNVD-200803-471

CONFIGURATIONS

sources: JVNDB: JVNDB-2008-004278

PATCH

title:

空調管理システムページ

url:

http://www.mitsubishielectric.co.jp/hvac_r/conditioning/products/control/

Trust: 0.8

sources: JVNDB: JVNDB-2008-004278

EXTERNAL IDS

db:	NVD	id:	CVE-2008-1546	Trust: 2.9
db:	BID	id:	28406	Trust: 1.9
db:	SREASON	id:	3794	Trust: 1.6
db:	CNNVD	id:	CNNVD-200803-471	Trust: 0.8
db:	JVNDB	id:	JVNDB-2008-004278	Trust: 0.8
db:	BUGTRAQ	id:	20080322 HACKING THE MITSUBISHI GB-50A	Trust: 0.6
db:	BUGTRAQ	id:	20071117 SECURITY CONTACT FOR MITSUBISHI ELECTRIC?	Trust: 0.6
db:	XF	id:	41503	Trust: 0.6
db:	XF	id:	50	Trust: 0.6
db:	IVD	id:	077962FC-23CE-11E6-ABEF-000C29C66E3D	Trust: 0.2

sources: IVD: 077962fc-23ce-11e6-abef-000c29c66e3d // BID: 28406 // JVNDB: JVNDB-2008-004278 // CNNVD: CNNVD-200803-471 // NVD: CVE-2008-1546

REFERENCES

url:	http://www.securityfocus.com/bid/28406	Trust: 1.6
url:	http://www.securityfocus.com/archive/1/483862/2008-03-21/threaded	Trust: 1.6
url:	http://securityreason.com/securityalert/3794	Trust: 1.6
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/41503	Trust: 1.0
url:	http://www.securityfocus.com/archive/1/489970/100/0/threaded	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-1546	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-1546	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/41503	Trust: 0.6
url:	http://www.securityfocus.com/archive/1/archive/1/489970/100/0/threaded	Trust: 0.6
url:	http://www.mrslim.com/home.asp	Trust: 0.3
url:	/archive/1/489970	Trust: 0.3

sources: BID: 28406 // JVNDB: JVNDB-2008-004278 // CNNVD: CNNVD-200803-471 // NVD: CVE-2008-1546

CREDITS

Chris Withers※ chris@simplistix.co.uk

Trust: 0.6

sources: CNNVD: CNNVD-200803-471

SOURCES

db:	IVD	id:	077962fc-23ce-11e6-abef-000c29c66e3d
db:	BID	id:	28406
db:	JVNDB	id:	JVNDB-2008-004278
db:	CNNVD	id:	CNNVD-200803-471
db:	NVD	id:	CVE-2008-1546

LAST UPDATE DATE

2024-11-23T22:19:44.133000+00:00

SOURCES UPDATE DATE

db:	BID	id:	28406	date:	2015-05-07T17:32:00
db:	JVNDB	id:	JVNDB-2008-004278	date:	2012-09-25T00:00:00
db:	CNNVD	id:	CNNVD-200803-471	date:	2009-03-18T00:00:00
db:	NVD	id:	CVE-2008-1546	date:	2024-11-21T00:44:46.840

SOURCES RELEASE DATE

db:	IVD	id:	077962fc-23ce-11e6-abef-000c29c66e3d	date:	2008-03-28T00:00:00
db:	BID	id:	28406	date:	2008-03-22T00:00:00
db:	JVNDB	id:	JVNDB-2008-004278	date:	2012-09-25T00:00:00
db:	CNNVD	id:	CNNVD-200803-471	date:	2008-03-28T00:00:00
db:	NVD	id:	CVE-2008-1546	date:	2008-03-28T23:44:00