Sign-up

ID

VAR-202409-1537


CVE

CVE-2024-37187


TITLE

Advantech Co., Ltd.  adam-5550  Insufficient Credential Protection Vulnerability in Firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-009909

DESCRIPTION

Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding. Advantech Co., Ltd. adam-5550 A firmware vulnerability related to insufficient protection of credentials exists.Information may be obtained. Advantech ADAM-5550 is a programmable automation controller from Advantech, a Chinese company. An attacker can exploit this vulnerability to obtain credential information and use this information to launch further attacks on the affected system

Trust: 2.16

sources: NVD: CVE-2024-37187 // JVNDB: JVNDB-2024-009909 // CNVD: CNVD-2024-39678

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-39678

AFFECTED PRODUCTS

vendor:advantechmodel:adam-5550scope:eqversion: -

Trust: 1.0

vendor:アドバンテック株式会社model:adam-5550scope:eqversion: -

Trust: 0.8

vendor:アドバンテック株式会社model:adam-5550scope: - version: -

Trust: 0.8

vendor:アドバンテック株式会社model:adam-5550scope:eqversion:adam-5550 firmware

Trust: 0.8

vendor:advantechmodel:adam-5550scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2024-39678 // JVNDB: JVNDB-2024-009909 // NVD: CVE-2024-37187

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-37187
value: MEDIUM

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2024-37187
value: MEDIUM

Trust: 1.0

NVD: CVE-2024-37187
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2024-39678
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2024-39678
severity: MEDIUM
baseScore: 6.1
vectorString: AV:A/AC:L/AU:N/C:C/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-37187
baseSeverity: MEDIUM
baseScore: 5.7
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.1
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: CVE-2024-37187
baseSeverity: MEDIUM
baseScore: 5.7
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-39678 // JVNDB: JVNDB-2024-009909 // NVD: CVE-2024-37187 // NVD: CVE-2024-37187

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.0

problemtype:CWE-261

Trust: 1.0

problemtype:Use Weak Ciphers for Passwords (CWE-261) [ others ]

Trust: 0.8

problemtype: Inadequate protection of credentials (CWE-522) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-009909 // NVD: CVE-2024-37187

PATCH

title:Patch for Advantech ADAM-5550 Information Disclosure Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/598301

Trust: 0.6

sources: CNVD: CNVD-2024-39678

EXTERNAL IDS

db:NVDid:CVE-2024-37187

Trust: 3.2

db:ICS CERTid:ICSA-24-270-01

Trust: 2.4

db:JVNid:JVNVU91291521

Trust: 0.8

db:JVNDBid:JVNDB-2024-009909

Trust: 0.8

db:CNVDid:CNVD-2024-39678

Trust: 0.6

sources: CNVD: CNVD-2024-39678 // JVNDB: JVNDB-2024-009909 // NVD: CVE-2024-37187

REFERENCES

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01

Trust: 2.4

url:https://jvn.jp/vu/jvnvu91291521/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-37187

Trust: 0.8

sources: CNVD: CNVD-2024-39678 // JVNDB: JVNDB-2024-009909 // NVD: CVE-2024-37187

SOURCES

db:CNVDid:CNVD-2024-39678
db:JVNDBid:JVNDB-2024-009909
db:NVDid:CVE-2024-37187

LAST UPDATE DATE

2024-10-09T22:37:37.259000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-39678date:2024-10-01T00:00:00
db:JVNDBid:JVNDB-2024-009909date:2024-10-08T01:21:00
db:NVDid:CVE-2024-37187date:2024-10-07T15:17:34.747

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-39678date:2024-10-01T00:00:00
db:JVNDBid:JVNDB-2024-009909date:2024-10-08T00:00:00
db:NVDid:CVE-2024-37187date:2024-09-27T18:15:04.690