SB2017101305 - Information disclosure in Siemens BACnet Field Panels
Published: October 13, 2017 Updated: May 26, 2022
Security Bulletin ID
SB2017101305
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Authentication bypass (CVE-ID: CVE-2017-9946)
The vulnerability allows a remote attacker to obtain potentially sensitive information.The weakness exists due to authentication bypass. A remote attacker with network access to the integrated web server (Ports 80/TCP and 443/TCP) can bypass authentication and download information from the device.
2) Path traversal (CVE-ID: CVE-2017-9947)
The vulnerability allows a remote attacker to obtain potentially sensitive information.The weakness exists due to path traversal. A remote attacker with network access to the integrated web server (Ports 80/TCP and 443/TCP) can obtain information on the structure of the file system of the affected devices.
Remediation
Install update from vendor's website.