Vulnerability-Lookup

BDU:2017-02111 (CVE-2016-9358)

Vulnerability from fstec – Published: 2017-09-22 – Updated: 2021-03-23 – View on bdu.fstec.ru No remediation information

Title

Summary

Уязвимость службы авторизации терминалов M3000 Terminal и M3210 Terminal, программного обеспечения M3000 Desktop, контроллера MAC4 Controller, рентгеновских аппаратов SensorX23 X-ray Machine и SensorX25 X-ray Machine, системы взвешивания MWS2 Weighing System связана с использованием неизменяемых предустановленных системных учетных записей. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ администратора к соответствующим устройствам

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Authentication bypass

Incidents

Being clarified

Remediation

Organisational measures

CWE

CWE-798 - Жесткое кодирование регистрационных данных

Aliases

CVE-2016-9358, BID ID:97388

References

2 references

URL
http://www.securityfocus.com/bid/97388
https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02

Impacted products

7 products from 1 vendor

Vendors

Marel Food Processing Systems

Products

M3000 Terminal, M3210 Terminal, M3000 Desktop, MAC4 Сontroller, SensorX23 X-ray machine, SensorX25 X-ray machine, MWS2 Weighing System

Versions

A320 (M3000 Terminal), A325 (M3000 Terminal), A371 (M3000 Terminal), A520 Master (M3000 Terminal), A520 Slave (M3000 Terminal), A530 (M3000 Terminal), A542 (M3000 Terminal), A571 (M3000 Terminal), Check Bin Grader (M3000 Terminal), FlowlineQC T376 (M3000 Terminal), IPM3 Dual Cam v132 (M3000 Terminal), IPM3 Dual Cam v139 (M3000 Terminal), IPM3 Single Cam v132 (M3000 Terminal), P520 (M3000 Terminal), P574 (M3000 Terminal), SensorX13 QC flow line (M3000 Terminal), SensorX23 QC Master (M3000 Terminal), SensorX23 QC Slave (M3000 Terminal), Speed Batcher (M3000 Terminal), T374 (M3000 Terminal), T377 (M3000 Terminal), V36 (M3000 Terminal), V36B (M3000 Terminal), V36C (M3000 Terminal), A320 (M3210 Terminal), A325 (M3210 Terminal), A371 (M3210 Terminal), A520 Master (M3210 Terminal), A520 Slave (M3210 Terminal), A530 (M3210 Terminal), A542 (M3210 Terminal), A571 (M3210 Terminal), Check Bin Grader (M3210 Terminal), FlowlineQC T376 (M3210 Terminal), IPM3 Dual Cam v132 (M3210 Terminal), IPM3 Dual Cam v139 (M3210 Terminal), IPM3 Single Cam v132 (M3210 Terminal), P520 (M3210 Terminal), P574 (M3210 Terminal), SensorX13 QC flow line (M3210 Terminal), SensorX23 QC Master (M3210 Terminal), SensorX23 QC Slave (M3210 Terminal), Speed Batcher (M3210 Terminal), T374 (M3210 Terminal), T377 (M3210 Terminal), V36 (M3210 Terminal), V36B (M3210 Terminal), V36C (M3210 Terminal), A320 (M3000 Desktop), A325 (M3000 Desktop), A371 (M3000 Desktop), A520 Master (M3000 Desktop), A520 Slave (M3000 Desktop), A530 (M3000 Desktop), A542 (M3000 Desktop), A571 (M3000 Desktop), Check Bin Grader (M3000 Desktop), FlowlineQC T376 (M3000 Desktop), IPM3 Dual Cam v132 (M3000 Desktop), IPM3 Dual Cam v139 (M3000 Desktop), IPM3 Single Cam v132 (M3000 Desktop), P520 (M3000 Desktop), P574 (M3000 Desktop), SensorX13 QC flow line (M3000 Desktop), SensorX23 QC Master (M3000 Desktop), SensorX23 QC Slave (M3000 Desktop), Speed Batcher (M3000 Desktop), T374 (M3000 Desktop), T377 (M3000 Desktop), V36 (M3000 Desktop), V36B (M3000 Desktop), V36C (M3000 Desktop), A320 (MAC4 Сontroller), A325 (MAC4 Сontroller), A371 (MAC4 Сontroller), A520 Master (MAC4 Сontroller), A520 Slave (MAC4 Сontroller), A530 (MAC4 Сontroller), A542 (MAC4 Сontroller), A571 (MAC4 Сontroller), Check Bin Grader (MAC4 Сontroller), FlowlineQC T376 (MAC4 Сontroller), IPM3 Dual Cam v132 (MAC4 Сontroller), IPM3 Dual Cam v139 (MAC4 Сontroller), IPM3 Single Cam v132 (MAC4 Сontroller), P520 (MAC4 Сontroller), P574 (MAC4 Сontroller), SensorX13 QC flow line (MAC4 Сontroller), SensorX23 QC Master (MAC4 Сontroller), SensorX23 QC Slave (MAC4 Сontroller), Speed Batcher (MAC4 Сontroller), T374 (MAC4 Сontroller), T377 (MAC4 Сontroller), V36 (MAC4 Сontroller), V36B (MAC4 Сontroller), V36C (MAC4 Сontroller), - (SensorX23 X-ray machine), - (SensorX25 X-ray machine), - (MWS2 Weighing System)

Product types

ПО программно-аппаратного средства АСУ ТП, Network appliance software

Mitigations

Принятие ограничительных мер для минимизации риска использования данной уязвимости

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Marel Food Processing Systems",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "A320 (M3000 Terminal), A325 (M3000 Terminal), A371 (M3000 Terminal), A520 Master (M3000 Terminal), A520 Slave (M3000 Terminal), A530 (M3000 Terminal), A542 (M3000 Terminal), A571 (M3000 Terminal), Check Bin Grader (M3000 Terminal), FlowlineQC T376 (M3000 Terminal), IPM3 Dual Cam v132 (M3000 Terminal), IPM3 Dual Cam v139 (M3000 Terminal), IPM3 Single Cam v132 (M3000 Terminal), P520 (M3000 Terminal), P574 (M3000 Terminal), SensorX13 QC flow line (M3000 Terminal), SensorX23 QC Master (M3000 Terminal), SensorX23 QC Slave (M3000 Terminal), Speed Batcher (M3000 Terminal), T374 (M3000 Terminal), T377 (M3000 Terminal), V36 (M3000 Terminal), V36B (M3000 Terminal), V36C (M3000 Terminal), A320 (M3210 Terminal), A325 (M3210 Terminal), A371 (M3210 Terminal), A520 Master (M3210 Terminal), A520 Slave (M3210 Terminal), A530 (M3210 Terminal), A542 (M3210 Terminal), A571 (M3210 Terminal), Check Bin Grader (M3210 Terminal), FlowlineQC T376 (M3210 Terminal), IPM3 Dual Cam v132 (M3210 Terminal), IPM3 Dual Cam v139 (M3210 Terminal), IPM3 Single Cam v132 (M3210 Terminal), P520 (M3210 Terminal), P574 (M3210 Terminal), SensorX13 QC flow line (M3210 Terminal), SensorX23 QC Master (M3210 Terminal), SensorX23 QC Slave (M3210 Terminal), Speed Batcher (M3210 Terminal), T374 (M3210 Terminal), T377 (M3210 Terminal), V36 (M3210 Terminal), V36B (M3210 Terminal), V36C (M3210 Terminal), A320 (M3000 Desktop), A325 (M3000 Desktop), A371 (M3000 Desktop), A520 Master (M3000 Desktop), A520 Slave (M3000 Desktop), A530 (M3000 Desktop), A542 (M3000 Desktop), A571 (M3000 Desktop), Check Bin Grader (M3000 Desktop), FlowlineQC T376 (M3000 Desktop), IPM3 Dual Cam v132 (M3000 Desktop), IPM3 Dual Cam v139 (M3000 Desktop), IPM3 Single Cam v132 (M3000 Desktop), P520 (M3000 Desktop), P574 (M3000 Desktop), SensorX13 QC flow line (M3000 Desktop), SensorX23 QC Master (M3000 Desktop), SensorX23 QC Slave (M3000 Desktop), Speed Batcher (M3000 Desktop), T374 (M3000 Desktop), T377 (M3000 Desktop), V36 (M3000 Desktop), V36B (M3000 Desktop), V36C (M3000 Desktop), A320 (MAC4 \u0421ontroller), A325 (MAC4 \u0421ontroller), A371 (MAC4 \u0421ontroller), A520 Master (MAC4 \u0421ontroller), A520 Slave (MAC4 \u0421ontroller), A530 (MAC4 \u0421ontroller), A542 (MAC4 \u0421ontroller), A571 (MAC4 \u0421ontroller), Check Bin Grader (MAC4 \u0421ontroller), FlowlineQC T376 (MAC4 \u0421ontroller), IPM3 Dual Cam v132 (MAC4 \u0421ontroller), IPM3 Dual Cam v139 (MAC4 \u0421ontroller), IPM3 Single Cam v132 (MAC4 \u0421ontroller), P520 (MAC4 \u0421ontroller), P574 (MAC4 \u0421ontroller), SensorX13 QC flow line (MAC4 \u0421ontroller), SensorX23 QC Master (MAC4 \u0421ontroller), SensorX23 QC Slave (MAC4 \u0421ontroller), Speed Batcher (MAC4 \u0421ontroller), T374 (MAC4 \u0421ontroller), T377 (MAC4 \u0421ontroller), V36 (MAC4 \u0421ontroller), V36B (MAC4 \u0421ontroller), V36C (MAC4 \u0421ontroller), - (SensorX23 X-ray machine), - (SensorX25 X-ray machine), - (MWS2 Weighing System)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043c\u0435\u0440 \u0434\u043b\u044f \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0438\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "04.04.2017",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.09.2017",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2017-02111",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2016-9358, BID ID:97388",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "M3000 Terminal, M3210 Terminal, M3000 Desktop, MAC4 \u0421ontroller, SensorX23 X-ray machine, SensorX25 X-ray machine, MWS2 Weighing System",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u043e\u0432 M3000 Terminal \u0438 M3210 Terminal, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f M3000 Desktop, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 MAC4 Controller, \u0440\u0435\u043d\u0442\u0433\u0435\u043d\u043e\u0432\u0441\u043a\u0438\u0445 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043e\u0432 SensorX23 X-ray Machine \u0438 SensorX25 X-ray Machine, \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0437\u0432\u0435\u0448\u0438\u0432\u0430\u043d\u0438\u044f MWS2 Weighing System, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0416\u0435\u0441\u0442\u043a\u043e\u0435 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-798)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u043e\u0432 M3000 Terminal \u0438 M3210 Terminal, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f M3000 Desktop, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 MAC4 Controller, \u0440\u0435\u043d\u0442\u0433\u0435\u043d\u043e\u0432\u0441\u043a\u0438\u0445 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043e\u0432 SensorX23 X-ray Machine \u0438 SensorX25 X-ray Machine, \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0437\u0432\u0435\u0448\u0438\u0432\u0430\u043d\u0438\u044f MWS2 Weighing System \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0438\u0437\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0435\u0434\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.securityfocus.com/bid/97388\nhttps://ics-cert.us-cert.gov/advisories/ICSA-17-094-02",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-798",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)"
}

CVE-2016-9358 (GCVE-0-2016-9358)

Vulnerability from cvelistv5 – Published: 2017-06-30 02:35 – Updated: 2024-08-06 02:50

Summary

A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. The end user does not have the ability to change system passwords.

Severity

No CVSS data available.

CWE

CWE-259

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 343 records in the last 180 days details

References

2 references

URL	Tags
http://www.securityfocus.com/bid/97388	vdb-entryx_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Marel Food Processing Systems	Affected: Marel Food Processing Systems

Date Public

2017-06-29 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:50:37.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "97388",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97388"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Marel Food Processing Systems",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Marel Food Processing Systems"
            }
          ]
        }
      ],
      "datePublic": "2017-06-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. The end user does not have the ability to change system passwords."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T09:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "97388",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97388"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2016-9358",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Marel Food Processing Systems",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Marel Food Processing Systems"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. The end user does not have the ability to change system passwords."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-259"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "97388",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97388"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2016-9358",
    "datePublished": "2017-06-30T02:35:00.000Z",
    "dateReserved": "2016-11-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:50:37.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted