Multiple vulnerabilities in JanTek JTC-200

Published: 2017-10-11

Risk	Low
Patch available	NO
Number of vulnerabilities	2
CVE-ID	CVE-2017-5789 CVE-2017-5791
CWE-ID	CWE-352 CWE-287
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	JTC-200 Hardware solutions / Firmware
Vendor	JanTek Electronics

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site request forgery

EUVDB-ID: #VU8799

Risk: Low

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2017-5789

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to perform CSRF attack.

The weakness exists due to a lack of cross-site request forgery (CSRF) protection. A remote attacker can create a specially crafted HTML page or URL, trick the victim into visiting it, gain access to the system and perform arbitrary actions.

Mitigation

Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

Vulnerable software versions

JTC-200: All versions

External links

http://ics-cert.us-cert.gov/advisories/ICSA-17-283-02

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Authentication bypass

EUVDB-ID: #VU8800