cnvd - cnvd-2017-23006

CNVD-2017-23006

Vulnerability from cnvd - Published: 2017-08-26

Title

多款PDQ产品权限获取漏洞

Description

PDQ Manufacturing LaserWash G5等都是美国PDQ Manufacturing公司的汽车自动清洗设备。web-server是其中的一个Web服务器。多款PDQ产品中的web-server存在安全漏洞，由于程序未能验证身份验证信息是否正确。攻击者可利用该漏洞获取系统的访问权限，发布命令，影响系统的正常运行。

Severity

高

Patch Name

多款PDQ产品权限获取漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： http://www.pdqinc.com/

Reference

https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03

Impacted products

Name
['PDQ Manufacturing LaserWash G5', 'PDQ Manufacturing LaserWash G5 S', 'PDQ Manufacturing LaserWash M5', 'PDQ Manufacturing LaserWash 360', 'PDQ Manufacturing LaserWash 360 Plus', 'PDQ Manufacturing LaserWash AutoXpress', 'PDQ Manufacturing LaserWash AutoExpress Plus', 'PDQ Manufacturing LaserJet', 'PDQ Manufacturing ProTouch Tandem', 'PDQ Manufacturing ProTouch ICON', 'PDQ Manufacturing ProTouch AutoGloss']

Name

['PDQ Manufacturing LaserWash G5', 'PDQ Manufacturing LaserWash G5 S', 'PDQ Manufacturing LaserWash M5', 'PDQ Manufacturing LaserWash 360', 'PDQ Manufacturing LaserWash 360 Plus', 'PDQ Manufacturing LaserWash AutoXpress', 'PDQ Manufacturing LaserWash AutoExpress Plus', 'PDQ Manufacturing LaserJet', 'PDQ Manufacturing ProTouch Tandem', 'PDQ Manufacturing ProTouch ICON', 'PDQ Manufacturing ProTouch AutoGloss']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-9630"
    }
  },
  "description": "PDQ Manufacturing LaserWash G5\u7b49\u90fd\u662f\u7f8e\u56fdPDQ Manufacturing\u516c\u53f8\u7684\u6c7d\u8f66\u81ea\u52a8\u6e05\u6d17\u8bbe\u5907\u3002web-server\u662f\u5176\u4e2d\u7684\u4e00\u4e2aWeb\u670d\u52a1\u5668\u3002\r\n\r\n\u591a\u6b3ePDQ\u4ea7\u54c1\u4e2d\u7684web-server\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u8eab\u4efd\u9a8c\u8bc1\u4fe1\u606f\u662f\u5426\u6b63\u786e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u7cfb\u7edf\u7684\u8bbf\u95ee\u6743\u9650\uff0c\u53d1\u5e03\u547d\u4ee4\uff0c\u5f71\u54cd\u7cfb\u7edf\u7684\u6b63\u5e38\u8fd0\u884c\u3002",
  "discovererName": "Billy Rios and Jonathan Butts of WhiteScope and Terry McCorkle",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://www.pdqinc.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-23006",
  "openTime": "2017-08-26",
  "patchDescription": "PDQ Manufacturing LaserWash G5\u7b49\u90fd\u662f\u7f8e\u56fdPDQ Manufacturing\u516c\u53f8\u7684\u6c7d\u8f66\u81ea\u52a8\u6e05\u6d17\u8bbe\u5907\u3002web-server\u662f\u5176\u4e2d\u7684\u4e00\u4e2aWeb\u670d\u52a1\u5668\u3002\r\n\r\n\u591a\u6b3ePDQ\u4ea7\u54c1\u4e2d\u7684web-server\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u8eab\u4efd\u9a8c\u8bc1\u4fe1\u606f\u662f\u5426\u6b63\u786e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u7cfb\u7edf\u7684\u8bbf\u95ee\u6743\u9650\uff0c\u53d1\u5e03\u547d\u4ee4\uff0c\u5f71\u54cd\u7cfb\u7edf\u7684\u6b63\u5e38\u8fd0\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3ePDQ\u4ea7\u54c1\u6743\u9650\u83b7\u53d6\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "PDQ Manufacturing LaserWash G5",
      "PDQ Manufacturing LaserWash G5 S",
      "PDQ Manufacturing LaserWash M5",
      "PDQ Manufacturing LaserWash 360",
      "PDQ Manufacturing LaserWash 360 Plus",
      "PDQ Manufacturing LaserWash AutoXpress",
      "PDQ Manufacturing LaserWash AutoExpress Plus",
      "PDQ Manufacturing LaserJet",
      "PDQ Manufacturing ProTouch Tandem",
      "PDQ Manufacturing ProTouch ICON",
      "PDQ Manufacturing ProTouch AutoGloss"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03",
  "serverity": "\u9ad8",
  "submitTime": "2017-08-03",
  "title": "\u591a\u6b3ePDQ\u4ea7\u54c1\u6743\u9650\u83b7\u53d6\u6f0f\u6d1e"
}

CVE-2017-9630 (GCVE-0-2017-9630)

Vulnerability from cvelistv5 – Published: 2017-08-07 08:00 – Updated: 2024-08-05 17:11

Summary

An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The web server does not properly verify that provided authentication information is correct.

Severity ?

No CVSS data available.

CWE

CWE-287

Assigner

icscert

References

URL

Tags

https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch	Affected: PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:11:02.365Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch"
            }
          ]
        }
      ],
      "datePublic": "2017-08-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The web server does not properly verify that provided authentication information is correct."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T07:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-9630",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The web server does not properly verify that provided authentication information is correct."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2017-9630",
    "datePublished": "2017-08-07T08:00:00",
    "dateReserved": "2017-06-14T00:00:00",
    "dateUpdated": "2024-08-05T17:11:02.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-23006

CVE-2017-9630 (GCVE-0-2017-9630)

Tags

Sightings

Nomenclature