Lucene search

IcscertCVE-2017-5145

HistoryFeb 13, 2017 - 9:59 p.m.

CVE-2017-5145

2017-02-1321:59:02

CWE-352

icscert

web.nvd.nist.gov

cve-2017-5145

carlo gavazzi vmu-c em

carlo gavazzi vmu-c pv

csrf

vulnerability

unauthorized actions

firmware

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

52.5%

JSON

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.

Affected configurations

Nvd

Node

carlosgavazzivmu-c_em_firmwareMatch-

AND

carlosgavazzivmu-c_emMatch-

Node

carlosgavazzivmu-c_pv_firmwareMatch-

AND

carlosgavazzivmu-c_pvMatch-

VendorProductVersionCPE
carlosgavazzivmu-c_em_firmware-cpe:2.3:o:carlosgavazzi:vmu-c_em_firmware:-:*:*:*:*:*:*:*
carlosgavazzivmu-c_em-cpe:2.3:h:carlosgavazzi:vmu-c_em:-:*:*:*:*:*:*:*
carlosgavazzivmu-c_pv_firmware-cpe:2.3:o:carlosgavazzi:vmu-c_pv_firmware:-:*:*:*:*:*:*:*
carlosgavazzivmu-c_pv-cpe:2.3:h:carlosgavazzi:vmu-c_pv:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
carlosgavazzi	vmu-c_em_firmware	-	cpe:2.3:o:carlosgavazzi:vmu-c_em_firmware:-:::::::*
carlosgavazzi	vmu-c_em	-	cpe:2.3:h:carlosgavazzi:vmu-c_em:-:::::::*
carlosgavazzi	vmu-c_pv_firmware	-	cpe:2.3:o:carlosgavazzi:vmu-c_pv_firmware:-:::::::*
carlosgavazzi	vmu-c_pv	-	cpe:2.3:h:carlosgavazzi:vmu-c_pv:-:::::::*

CNA Affected

[
  {
    "product": "Carlo Gavazzi VMU-C EM and VMU-C PV",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Carlo Gavazzi VMU-C EM and VMU-C PV"
      }
    ]
  }
]

References

www.securityfocus.com/bid/95411

ics-cert.us-cert.gov/advisories/ICSA-17-012-03

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

52.5%

JSON

Related for CVE-2017-5145