Details of VAR-201708-1517

ID

VAR-201708-1517

CVE

CVE-2017-9940

TITLE

Siemens SiPass integrated Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-006972

DESCRIPTION

A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with access to a low-privileged user account to read or write files on the file system of the SiPass integrated server over the network. Siemens SiPass integrated Contains an access control vulnerability.Information may be obtained and information may be altered. The SiPass server is a component of the SiPass centralized access control system that receives the client's connection for communication. There is a file read/write vulnerability in Siemens SiPass integrated. An authentication-bypass vulnerability 2. A privilege-escalation vulnerability 3. A man-in-the-middle security bypass vulnerability 4. An information-disclosure vulnerability An attacker may leverage these issues to disclose sensitive information, perform certain unauthorized actions by conducting a man-in-the-middle attack, gain unauthorized access or elevated privileges. Versions prior to SiPass integrated 2.70 are vulnerable

Trust: 2.7

sources: NVD: CVE-2017-9940 // JVNDB: JVNDB-2017-006972 // CNVD: CNVD-2017-14603 // BID: 99578 // IVD: 6ba0449d-be86-414d-9d46-b1977cf1c756 // VULHUB: VHN-118143

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 6ba0449d-be86-414d-9d46-b1977cf1c756 // CNVD: CNVD-2017-14603

AFFECTED PRODUCTS

vendor:	siemens	model:	sipass integrated	scope:	lte	version:	2.65	Trust: 1.0
vendor:	siemens	model:	sipass integrated	scope:	eq	version:	2.70	Trust: 0.8
vendor:	siemens	model:	sipass integrated	scope:	lt	version:	2.70	Trust: 0.6
vendor:	siemens	model:	sipass integrated	scope:	eq	version:	2.65	Trust: 0.6
vendor:	siemens	model:	sipass integrated mp2.6	scope:	-	version:	-	Trust: 0.3
vendor:	siemens	model:	sipass integrated mp2.5	scope:	-	version:	-	Trust: 0.3
vendor:	siemens	model:	sipass integrated mp2.4	scope:	-	version:	-	Trust: 0.3
vendor:	siemens	model:	sipass integrated	scope:	ne	version:	2.70	Trust: 0.3
vendor:	sipass integrated	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 6ba0449d-be86-414d-9d46-b1977cf1c756 // CNVD: CNVD-2017-14603 // BID: 99578 // JVNDB: JVNDB-2017-006972 // CNNVD: CNNVD-201707-606 // NVD: CVE-2017-9940

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-9940
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-9940
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-14603
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201707-606
value:	HIGH
Trust: 0.6
IVD:	6ba0449d-be86-414d-9d46-b1977cf1c756
value:	HIGH
Trust: 0.2
VULHUB:	VHN-118143
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-9940
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-14603
severity:	HIGH
baseScore:	9.4
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	9.2
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	6ba0449d-be86-414d-9d46-b1977cf1c756
severity:	HIGH
baseScore:	9.4
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	9.2
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-118143
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-9940
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	5.2
version:	3.0
Trust: 1.8

sources: IVD: 6ba0449d-be86-414d-9d46-b1977cf1c756 // CNVD: CNVD-2017-14603 // VULHUB: VHN-118143 // JVNDB: JVNDB-2017-006972 // CNNVD: CNNVD-201707-606 // NVD: CVE-2017-9940

PROBLEMTYPE DATA

problemtype:	CWE-269	Trust: 1.1
problemtype:	CWE-284	Trust: 0.9

sources: VULHUB: VHN-118143 // JVNDB: JVNDB-2017-006972 // NVD: CVE-2017-9940

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-606

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201707-606

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-006972

PATCH

title:	SSA-339433	url:	https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf	Trust: 0.8
title:	Siemens SiPass integrated file read and write vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/98176	Trust: 0.6
title:	Siemens SiPass integrated Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71720	Trust: 0.6

sources: CNVD: CNVD-2017-14603 // JVNDB: JVNDB-2017-006972 // CNNVD: CNNVD-201707-606

EXTERNAL IDS

db:	NVD	id:	CVE-2017-9940	Trust: 3.6
db:	SIEMENS	id:	SSA-339433	Trust: 2.6
db:	BID	id:	99578	Trust: 2.0
db:	CNNVD	id:	CNNVD-201707-606	Trust: 0.9
db:	CNVD	id:	CNVD-2017-14603	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-006972	Trust: 0.8
db:	ICS CERT	id:	ICSA-17-194-01	Trust: 0.3
db:	IVD	id:	6BA0449D-BE86-414D-9D46-B1977CF1C756	Trust: 0.2
db:	VULHUB	id:	VHN-118143	Trust: 0.1

sources: IVD: 6ba0449d-be86-414d-9d46-b1977cf1c756 // CNVD: CNVD-2017-14603 // VULHUB: VHN-118143 // BID: 99578 // JVNDB: JVNDB-2017-006972 // CNNVD: CNNVD-201707-606 // NVD: CVE-2017-9940

REFERENCES

url:	https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf	Trust: 2.6
url:	http://www.securityfocus.com/bid/99578	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9940	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-9940	Trust: 0.8
url:	http://subscriber.communications.siemens.com/	Trust: 0.3
url:	https://ics-cert.us-cert.gov/advisories/icsa-17-194-01	Trust: 0.3

sources: CNVD: CNVD-2017-14603 // VULHUB: VHN-118143 // BID: 99578 // JVNDB: JVNDB-2017-006972 // CNNVD: CNNVD-201707-606 // NVD: CVE-2017-9940

CREDITS

Siemens

Trust: 0.3

sources: BID: 99578

SOURCES

db:	IVD	id:	6ba0449d-be86-414d-9d46-b1977cf1c756
db:	CNVD	id:	CNVD-2017-14603
db:	VULHUB	id:	VHN-118143
db:	BID	id:	99578
db:	JVNDB	id:	JVNDB-2017-006972
db:	CNNVD	id:	CNNVD-201707-606
db:	NVD	id:	CVE-2017-9940

LAST UPDATE DATE

2024-11-23T21:53:48.700000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-14603	date:	2017-07-15T00:00:00
db:	VULHUB	id:	VHN-118143	date:	2019-10-09T00:00:00
db:	BID	id:	99578	date:	2017-07-13T00:00:00
db:	JVNDB	id:	JVNDB-2017-006972	date:	2017-09-07T00:00:00
db:	CNNVD	id:	CNNVD-201707-606	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-9940	date:	2024-11-21T03:37:13.167

SOURCES RELEASE DATE

db:	IVD	id:	6ba0449d-be86-414d-9d46-b1977cf1c756	date:	2017-07-15T00:00:00
db:	CNVD	id:	CNVD-2017-14603	date:	2017-07-15T00:00:00
db:	VULHUB	id:	VHN-118143	date:	2017-08-08T00:00:00
db:	BID	id:	99578	date:	2017-07-13T00:00:00
db:	JVNDB	id:	JVNDB-2017-006972	date:	2017-09-07T00:00:00
db:	CNNVD	id:	CNNVD-201707-606	date:	2017-07-14T00:00:00
db:	NVD	id:	CVE-2017-9940	date:	2017-08-08T00:29:00.417