Sign-up

ID

VAR-201710-1428


CVE

CVE-2017-9947


TITLE

Siemens BACnet Field Panels Directory Traversal Vulnerability

Trust: 0.8

sources: IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7 // CNVD: CNVD-2017-29972

DESCRIPTION

A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices. BACnet (Building Automation Control Network) is a data communication protocol for building automation and control networks. A directory traversal vulnerability exists in Siemens BACnet Field Panels. Multiple Siemens Products are prone to an authentication-bypass and directory-traversal vulnerabilities. Attackers may exploit these issues to gain unauthorized access to restricted content by bypassing intended security restrictions or to obtain sensitive information that may aid in launching further attacks

Trust: 2.7

sources: NVD: CVE-2017-9947 // JVNDB: JVNDB-2017-009851 // CNVD: CNVD-2017-29972 // BID: 101248 // IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7 // VULMON: CVE-2017-9947

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7 // CNVD: CNVD-2017-29972

AFFECTED PRODUCTS

vendor:siemensmodel:apogee pxcscope:ltversion:3.5

Trust: 1.0

vendor:siemensmodel:apogee pxc modularscope:ltversion:3.5

Trust: 1.0

vendor:siemensmodel:talon tc modularscope:ltversion:3.5

Trust: 1.0

vendor:siemensmodel:talon tc compactscope:ltversion:3.5

Trust: 1.0

vendor:siemensmodel:apogee pxc bacnet automation controllerscope:ltversion:3.5

Trust: 0.8

vendor:siemensmodel:talon tc bacnet automation controllerscope:ltversion:3.5

Trust: 0.8

vendor:siemensmodel:apogee pxc bacnet automation controllersscope:ltversion:v3.5

Trust: 0.6

vendor:siemensmodel:talon tc bacnet automation controllersscope:ltversion:v3.5

Trust: 0.6

vendor:apogee pxc bacnet automation controllermodel: - scope:eqversion:*

Trust: 0.4

vendor:siemensmodel:talon tc bacnet automation controllersscope:eqversion:3.4

Trust: 0.3

vendor:siemensmodel:apogee pxc bacnet automation controllersscope:eqversion:3.4

Trust: 0.3

vendor:siemensmodel:talon tc bacnet automation controllersscope:neversion:3.5

Trust: 0.3

vendor:siemensmodel:apogee pxc bacnet automation controllersscope:neversion:3.5

Trust: 0.3

sources: IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7 // CNVD: CNVD-2017-29972 // BID: 101248 // JVNDB: JVNDB-2017-009851 // NVD: CVE-2017-9947

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9947
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-9947
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-29972
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201710-1050
value: MEDIUM

Trust: 0.6

IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7
value: MEDIUM

Trust: 0.2

VULMON: CVE-2017-9947
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-9947
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2017-29972
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-9947
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2017-9947
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7 // CNVD: CNVD-2017-29972 // VULMON: CVE-2017-9947 // JVNDB: JVNDB-2017-009851 // CNNVD: CNNVD-201710-1050 // NVD: CVE-2017-9947

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.8

problemtype:CWE-538

Trust: 1.0

sources: JVNDB: JVNDB-2017-009851 // NVD: CVE-2017-9947

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201710-1050

TYPE

Path traversal

Trust: 0.8

sources: IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7 // CNNVD: CNNVD-201710-1050

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-009851

PATCH
title:SSA-148078url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-148078.pdf
Trust: 0.8
title:Siemens BACnet Field Panels Directory Traversal Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/103553
Trust: 0.6
title:Siemens APOGEE PXC BACnet Automation Controller  and Siemens TALON TC BACnet Automation Controller Repair measures for path traversal vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=75922
Trust: 0.6
title: - url:https://github.com/RoseSecurity/APOLOGEE 
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-29972 // 
            
            
            
            VULMON: CVE-2017-9947 // 
            
            
            
            JVNDB: JVNDB-2017-009851 // 
            
            
            
            CNNVD: CNNVD-201710-1050

EXTERNAL IDS
db:NVDid:CVE-2017-9947
Trust: 3.6
db:ICS CERTid:ICSA-17-285-05
Trust: 2.4
db:BIDid:101248
Trust: 2.0
db:SIEMENSid:SSA-148078
Trust: 1.7
db:PACKETSTORMid:169544
Trust: 1.6
db:CNVDid:CNVD-2017-29972
Trust: 0.8
db:CNNVDid:CNNVD-201710-1050
Trust: 0.8
db:JVNDBid:JVNDB-2017-009851
Trust: 0.8
db:IVDid:5201F8EE-49EE-4F5D-9584-CEC33A2A5DE7
Trust: 0.2
db:VULMONid:CVE-2017-9947
Trust: 0.1
sources:
            
            
            IVD: 5201f8ee-49ee-4f5d-9584-cec33a2a5de7 // 
            
            
            
            CNVD: CNVD-2017-29972 // 
            
            
            
            VULMON: CVE-2017-9947 // 
            
            
            
            BID: 101248 // 
            
            
            
            JVNDB: JVNDB-2017-009851 // 
            
            
            
            CNNVD: CNNVD-201710-1050 // 
            
            
            
            NVD: CVE-2017-9947

REFERENCES
url:http://www.securityfocus.com/bid/101248
Trust: 1.8
url:https://ics-cert.us-cert.gov/advisories/icsa-17-285-05
Trust: 1.7
url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-148078.pdf
Trust: 1.7
url:https://cert-portal.siemens.com/productcert/pdf/ssa-148078.pdf
Trust: 1.7
url:http://packetstormsecurity.com/files/169544/siemens-apogee-pxc-talon-tc-authentication-bypass.html
Trust: 1.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9947
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-9947
Trust: 0.8
url:https://us-cert.cisa.gov/ics/advisories/icsa-17-285-05
Trust: 0.6
url:http://subscriber.communications.siemens.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/22.html
Trust: 0.1
url:https://github.com/rosesecurity/apologee
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.cisa.gov/uscert/ics/advisories/icsa-17-285-05
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-29972 // 
            
            
            
            VULMON: CVE-2017-9947 // 
            
            
            
            BID: 101248 // 
            
            
            
            JVNDB: JVNDB-2017-009851 // 
            
            
            
            CNNVD: CNNVD-201710-1050 // 
            
            
            
            NVD: CVE-2017-9947

CREDITS
RoseSecurity reported the vulnerabilities for APOGEE PXC Series (P2 Ethernet) devices to Siemens.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201710-1050

SOURCES
db:IVDid:5201f8ee-49ee-4f5d-9584-cec33a2a5de7
db:CNVDid:CNVD-2017-29972
db:VULMONid:CVE-2017-9947
db:BIDid:101248
db:JVNDBid:JVNDB-2017-009851
db:CNNVDid:CNNVD-201710-1050
db:NVDid:CVE-2017-9947

LAST UPDATE DATE
2024-11-23T22:07:09.818000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-29972date:2017-10-13T00:00:00
db:VULMONid:CVE-2017-9947date:2022-06-14T00:00:00
db:BIDid:101248date:2017-10-12T00:00:00
db:JVNDBid:JVNDB-2017-009851date:2017-11-24T00:00:00
db:CNNVDid:CNNVD-201710-1050date:2022-10-31T00:00:00
db:NVDid:CVE-2017-9947date:2024-11-21T03:37:13.890

SOURCES RELEASE DATE
db:IVDid:5201f8ee-49ee-4f5d-9584-cec33a2a5de7date:2017-10-13T00:00:00
db:CNVDid:CNVD-2017-29972date:2017-10-13T00:00:00
db:VULMONid:CVE-2017-9947date:2017-10-23T00:00:00
db:BIDid:101248date:2017-10-12T00:00:00
db:JVNDBid:JVNDB-2017-009851date:2017-11-24T00:00:00
db:CNNVDid:CNNVD-201710-1050date:2017-10-27T00:00:00
db:NVDid:CVE-2017-9947date:2017-10-23T08:29:00.867