Sign-up

ID

VAR-201809-0956


CVE

CVE-2018-16059


TITLE

Endress+Hauser WirelessHART Fieldgate SWG70 Path traversal vulnerability in devices

Trust: 0.8

sources: JVNDB: JVNDB-2018-009929

DESCRIPTION

Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter. Endress+Hauser WirelessHART Fieldgate SWG70 The device contains a path traversal vulnerability.Information may be obtained. Multiple PEPPERL+FUCHS products are prone to a directory-traversal vulnerability. Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve sensitive information. This may aid in further attacks. The following products and versions are affected: WirelessHART Gateway WHA-GW-F2D2-0-AS-Z2-ETH 03.00.08 WirelessHART Gateway WHA-GW-F2D2-0-AS-Z2-ETH.EIP 02.00.01. The Endress+Hauser WirelessHART Fieldgate SWG70 is an Ethernet gateway device. An attacker could exploit this vulnerability to view arbitrary files on the system

Trust: 2.07

sources: NVD: CVE-2018-16059 // JVNDB: JVNDB-2018-009929 // BID: 107416 // VULHUB: VHN-126380 // VULMON: CVE-2018-16059

AFFECTED PRODUCTS

vendor:endressmodel:wirelesshart fieldgate swg70scope:eqversion:3.00.07

Trust: 1.6

vendor:endless hausermodel:wirelesshart fieldgate swg70scope:eqversion:3.x

Trust: 0.8

vendor:pepperl fuchsmodel:wha-gw-f2d2-0-as-z2-eth.eipscope:eqversion:0

Trust: 0.3

vendor:pepperl fuchsmodel:wha-gw-f2d2-0-as-z2-ethscope:eqversion:0

Trust: 0.3

vendor:pepperl fuchsmodel:wha-gw-f2d2-0-as-z2-eth.eipscope:neversion:02.00.01

Trust: 0.3

vendor:pepperl fuchsmodel:wha-gw-f2d2-0-as-z2-ethscope:neversion:03.00.08

Trust: 0.3

sources: BID: 107416 // JVNDB: JVNDB-2018-009929 // CNNVD: CNNVD-201809-375 // NVD: CVE-2018-16059

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-16059
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-16059
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201809-375
value: MEDIUM

Trust: 0.6

VULHUB: VHN-126380
value: MEDIUM

Trust: 0.1

VULMON: CVE-2018-16059
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-16059
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-126380
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-16059
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-126380 // VULMON: CVE-2018-16059 // JVNDB: JVNDB-2018-009929 // CNNVD: CNNVD-201809-375 // NVD: CVE-2018-16059

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

sources: VULHUB: VHN-126380 // JVNDB: JVNDB-2018-009929 // NVD: CVE-2018-16059

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-375

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201809-375

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-009929

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-126380 // 
            
            
            
            VULMON: CVE-2018-16059

PATCH
title:WirelessHART フィールドゲート SWG70url:https://www.jp.endress.com/ja/Field-instruments-overview/System-Components-Recorder-Data-Manager/wirelesshart-gateway-fieldgate-swg70?highlight=SWG70
Trust: 0.8
title:Kenzer Templates [5170] [DEPRECATED]url:https://github.com/ARPSyndicate/kenzer-templates 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-16059 // 
            
            
            
            JVNDB: JVNDB-2018-009929

EXTERNAL IDS
db:NVDid:CVE-2018-16059
Trust: 2.9
db:ICS CERTid:ICSA-19-073-03
Trust: 2.9
db:EXPLOIT-DBid:45342
Trust: 2.6
db:BIDid:107416
Trust: 2.1
db:CERT@VDEid:VDE-2019-002
Trust: 1.8
db:JVNDBid:JVNDB-2018-009929
Trust: 0.8
db:CNNVDid:CNNVD-201809-375
Trust: 0.7
db:AUSCERTid:ESB-2019.0847
Trust: 0.6
db:VULHUBid:VHN-126380
Trust: 0.1
db:VULMONid:CVE-2018-16059
Trust: 0.1
sources:
            
            
            VULHUB: VHN-126380 // 
            
            
            
            VULMON: CVE-2018-16059 // 
            
            
            
            BID: 107416 // 
            
            
            
            JVNDB: JVNDB-2018-009929 // 
            
            
            
            CNNVD: CNNVD-201809-375 // 
            
            
            
            NVD: CVE-2018-16059

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-19-073-03
Trust: 3.5
url:https://www.exploit-db.com/exploits/45342/
Trust: 2.7
url:http://www.securityfocus.com/bid/107416
Trust: 2.4
url:https://cert.vde.com/en-us/advisories/vde-2019-002
Trust: 1.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16059
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-16059
Trust: 0.8
url:https://www.auscert.org.au/bulletins/77218
Trust: 0.6
url:https://www.pepperl-fuchs.com/global/en/index.htm
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/22.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/arpsyndicate/kenzer-templates
Trust: 0.1
sources:
            
            
            VULHUB: VHN-126380 // 
            
            
            
            VULMON: CVE-2018-16059 // 
            
            
            
            BID: 107416 // 
            
            
            
            JVNDB: JVNDB-2018-009929 // 
            
            
            
            CNNVD: CNNVD-201809-375 // 
            
            
            
            NVD: CVE-2018-16059

CREDITS
PEPPERL+FUCHS reported this vulnerability to CERT@VDE,The vendor reported this issue.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201809-375

SOURCES
db:VULHUBid:VHN-126380
db:VULMONid:CVE-2018-16059
db:BIDid:107416
db:JVNDBid:JVNDB-2018-009929
db:CNNVDid:CNNVD-201809-375
db:NVDid:CVE-2018-16059

LAST UPDATE DATE
2024-11-23T22:06:36.573000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-126380date:2019-03-21T00:00:00
db:VULMONid:CVE-2018-16059date:2019-03-21T00:00:00
db:BIDid:107416date:2019-03-14T00:00:00
db:JVNDBid:JVNDB-2018-009929date:2019-03-15T00:00:00
db:CNNVDid:CNNVD-201809-375date:2019-03-25T00:00:00
db:NVDid:CVE-2018-16059date:2024-11-21T03:52:01.173

SOURCES RELEASE DATE
db:VULHUBid:VHN-126380date:2018-09-07T00:00:00
db:VULMONid:CVE-2018-16059date:2018-09-07T00:00:00
db:BIDid:107416date:2019-03-14T00:00:00
db:JVNDBid:JVNDB-2018-009929date:2018-11-30T00:00:00
db:CNNVDid:CNNVD-201809-375date:2018-09-10T00:00:00
db:NVDid:CVE-2018-16059date:2018-09-07T22:29:01.743