Multiple vulnerabilities in Siemens APOGEE/TALON Field Panels
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2017-9946 CVE-2017-9947 |
| CWE-ID | CWE-288 CWE-22 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software Subscribe |
APOGEE PXC Compact (BACnet) Hardware solutions / Other hardware appliances APOGEE PXC Modular (BACnet) Hardware solutions / Other hardware appliances TALON TC Compact (BACnet) Hardware solutions / Other hardware appliances TALON TC Modular (BACnet) Hardware solutions / Other hardware appliances |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Authentication bypass
EUVDB-ID: #VU8819
Risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-9946
CWE-ID:
CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to authentication bypass. A remote attacker with network access to the integrated web server (Ports 80/TCP and 443/TCP) can bypass authentication and download information from the device.
Install update from vendor's website.
Vulnerable software versionsAPOGEE PXC Compact (BACnet): before 3.5
APOGEE PXC Modular (BACnet): before 3.5
TALON TC Compact (BACnet): before 3.5
TALON TC Modular (BACnet): before 3.5
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-148078.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Path traversal
EUVDB-ID: #VU8820
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2017-9947
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to path traversal. A remote attacker with network access to the integrated web server (Ports 80/TCP and 443/TCP) can obtain information on the structure of the file system of the affected devices.
Install update from vendor's website.
Vulnerable software versionsAPOGEE PXC Compact (BACnet): before 3.5
APOGEE PXC Modular (BACnet): before 3.5
TALON TC Compact (BACnet): before 3.5
TALON TC Modular (BACnet): before 3.5
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-148078.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
