Sign-up

ID

VAR-201705-3185


CVE

CVE-2017-6016


TITLE

LAquis SCADA Local Access Bypass Vulnerability

Trust: 0.8

sources: IVD: 08212888-7198-4132-aa3d-15ce85c5f3da // CNVD: CNVD-2017-05061

DESCRIPTION

An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following versions are affected: Versions 4.1 and prior versions released before January 20, 2017. An Improper Access Control vulnerability has been identified, which may allow an authenticated user to modify application files to escalate privileges. LAquis SCADA is a tool and language for data collection, process monitoring, industrial automation, storage and reporting for quality management and application development. LAquis SCADA has a local access bypass vulnerability. With this vulnerability, an attacker can bypass unauthorized security operations by bypassing some security restrictions. CVE-2017-6016 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Other vectors are possible as well. +++++

Trust: 2.7

sources: NVD: CVE-2017-6016 // JVNDB: JVNDB-2017-004290 // CNVD: CNVD-2017-05061 // BID: 96942 // IVD: 08212888-7198-4132-aa3d-15ce85c5f3da // PACKETSTORM: 142043

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 08212888-7198-4132-aa3d-15ce85c5f3da // CNVD: CNVD-2017-05061

AFFECTED PRODUCTS

vendor:leao consultoria e desenvolvimento de sistemasmodel:ltda me laquis scadascope:lteversion:4.1

Trust: 1.0

vendor:lcdsmodel:laquis scadascope:lteversion:4.1

Trust: 0.8

vendor:laquisscadamodel:ltda me laquis scadascope:eqversion:4.1

Trust: 0.6

vendor:leao consultoria e desenvolvimento de sistemasmodel:ltda me laquis scadascope:eqversion:4.1

Trust: 0.6

vendor:lcdsmodel:leão consultoria e desenvolvimento de sistemas ltda me laquis scadascope:eqversion:-4.1

Trust: 0.3

vendor:ltda me laquis scadamodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 08212888-7198-4132-aa3d-15ce85c5f3da // CNVD: CNVD-2017-05061 // BID: 96942 // JVNDB: JVNDB-2017-004290 // CNNVD: CNNVD-201702-596 // NVD: CVE-2017-6016

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6016
value: HIGH

Trust: 1.0

NVD: CVE-2017-6016
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-05061
value: LOW

Trust: 0.6

CNNVD: CNNVD-201702-596
value: HIGH

Trust: 0.6

IVD: 08212888-7198-4132-aa3d-15ce85c5f3da
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2017-6016
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-05061
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 08212888-7198-4132-aa3d-15ce85c5f3da
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-6016
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 08212888-7198-4132-aa3d-15ce85c5f3da // CNVD: CNVD-2017-05061 // JVNDB: JVNDB-2017-004290 // CNNVD: CNNVD-201702-596 // NVD: CVE-2017-6016

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.8

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: JVNDB: JVNDB-2017-004290 // NVD: CVE-2017-6016

THREAT TYPE

local

Trust: 0.9

sources: BID: 96942 // CNNVD: CNNVD-201702-596

TYPE

Access control error

Trust: 0.8

sources: IVD: 08212888-7198-4132-aa3d-15ce85c5f3da // CNNVD: CNNVD-201702-596

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-004290

PATCH
title:Top Pageurl:http://www.lcds.com.br/
Trust: 0.8
title:LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99648
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-004290 // 
            
            
            
            CNNVD: CNNVD-201702-596

EXTERNAL IDS
db:NVDid:CVE-2017-6016
Trust: 3.6
db:ICS CERTid:ICSA-17-075-01
Trust: 2.8
db:BIDid:96942
Trust: 2.5
db:CNVDid:CNVD-2017-05061
Trust: 0.8
db:CNNVDid:CNNVD-201702-596
Trust: 0.8
db:JVNDBid:JVNDB-2017-004290
Trust: 0.8
db:IVDid:08212888-7198-4132-AA3D-15CE85C5F3DA
Trust: 0.2
db:PACKETSTORMid:142043
Trust: 0.1
sources:
            
            
            IVD: 08212888-7198-4132-aa3d-15ce85c5f3da // 
            
            
            
            CNVD: CNVD-2017-05061 // 
            
            
            
            BID: 96942 // 
            
            
            
            JVNDB: JVNDB-2017-004290 // 
            
            
            
            PACKETSTORM: 142043 // 
            
            
            
            CNNVD: CNNVD-201702-596 // 
            
            
            
            NVD: CVE-2017-6016

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-075-01
Trust: 2.8
url:http://www.securityfocus.com/bid/96942
Trust: 2.2
url:https://nvd.nist.gov/vuln/detail/cve-2017-6016
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6016
Trust: 0.8
url:http://laquisscada.com/instale1.php
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-05061 // 
            
            
            
            BID: 96942 // 
            
            
            
            JVNDB: JVNDB-2017-004290 // 
            
            
            
            PACKETSTORM: 142043 // 
            
            
            
            CNNVD: CNNVD-201702-596 // 
            
            
            
            NVD: CVE-2017-6016

CREDITS
Karn Ganeshen
Trust: 0.4
sources:
            
            
            BID: 96942 // 
            
            
            
            PACKETSTORM: 142043

SOURCES
db:IVDid:08212888-7198-4132-aa3d-15ce85c5f3da
db:CNVDid:CNVD-2017-05061
db:BIDid:96942
db:JVNDBid:JVNDB-2017-004290
db:PACKETSTORMid:142043
db:CNNVDid:CNNVD-201702-596
db:NVDid:CVE-2017-6016

LAST UPDATE DATE
2024-08-14T15:44:25.383000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-05061date:2017-04-22T00:00:00
db:BIDid:96942date:2017-03-23T01:01:00
db:JVNDBid:JVNDB-2017-004290date:2017-06-21T00:00:00
db:CNNVDid:CNNVD-201702-596date:2019-10-17T00:00:00
db:NVDid:CVE-2017-6016date:2019-10-09T23:28:33.527

SOURCES RELEASE DATE
db:IVDid:08212888-7198-4132-aa3d-15ce85c5f3dadate:2017-04-22T00:00:00
db:CNVDid:CNVD-2017-05061date:2017-04-24T00:00:00
db:BIDid:96942date:2017-03-16T00:00:00
db:JVNDBid:JVNDB-2017-004290date:2017-06-21T00:00:00
db:PACKETSTORMid:142043date:2017-04-06T14:44:44
db:CNNVDid:CNNVD-201702-596date:2017-02-17T00:00:00
db:NVDid:CVE-2017-6016date:2017-05-19T03:29:00.403