CVE-2017-7916

Severity Score

6.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. The web application does not properly restrict privileges of the Guest account. A malicious user may be able to gain access to configuration information that should be restricted.

Se ha descubierto un problema de control de permisos, privilegios y accesos en ABB VSN300 WiFi Logger Card versiones 1.8.15 y anteriores, y VSN300 WiFi Logger Card for React versiones 2.1.3 y anteriores. La aplicación web no restringe privilegios de la cuenta de invitado correctamente. Un usuario malicioso podría ser capaz de conseguir acceso a información de configuración que debería estar restringida.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-04-18 CVE Reserved
2017-08-07 CVE Published
2023-03-07 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls
CWE-269: Improper Privilege Management

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/99558	Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-192-03	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://search.abb.com/library/Download.aspx?DocumentID=9AKK107045A1977&LanguageCode=en&DocumentPartId=&Action=Launch	2019-10-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Abb Search vendor "Abb"	Vsn300 Firmware Search vendor "Abb" for product "Vsn300 Firmware"	<= 1.8.15 Search vendor "Abb" for product "Vsn300 Firmware" and version " <= 1.8.15"	-	Affected	in	Abb Search vendor "Abb"	Vsn300 Search vendor "Abb" for product "Vsn300"	-	-	Safe
Abb Search vendor "Abb"	Vsn300 For React Firmware Search vendor "Abb" for product "Vsn300 For React Firmware"	2.1.3 Search vendor "Abb" for product "Vsn300 For React Firmware" and version "2.1.3"	-	Affected	in	Abb Search vendor "Abb"	Vsn300 For React Search vendor "Abb" for product "Vsn300 For React"	-	-	Safe