SB2017081005 - Information disclosure in ABB SREA-01 and SREA-50
Published: August 10, 2017 Updated: August 15, 2017
Security Bulletin ID
SB2017081005
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Relative path traversal (CVE-ID: CVE-2017-9664)
The vulnerability allows a remote attacker to obtain potentially sensitive information.The weakness exists due to relative path traversal. A remote attacker can send a specially crafted HTTP request, perform relative path traversal attack and gain access to internal files, view data, change configuration, retrieve password hash codes, and potentially insert and send commands to connected devices without authorization.
Remediation
Install update from vendor's website.