ICSA-17-138-01

Vulnerability from csaf_cisa - Published: 2017-05-18 00:00 - Updated: 2017-05-18 00:00
Summary
ICSA-17-138-01_Miele Professional PG 85 Series
Notes
CISA Disclaimer: This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary: Jens Regel of Schneider & Wulf publicly disclosed this vulnerability without ICS-CERT coordination.
CVE-2017-7240
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Mitigation Miele Professional issued patches for this vulnerability on May 4, 2017. Miele Professional is in the process of contacting all affected users via registered mail.
Mitigation Users of affected machines can contact Miele Professional at 1-800-991-9380 to schedule service for a software update, which must be performed by a Miele Professional technician.
Mitigation Miele Professional PG 85 series PG8527 version 2.02: Update to version 2.12
Mitigation Miele Professional PG 85 series PG8527 version 2.51: Update to version 2.61
Mitigation Miele Professional PG 85 series PG8527 version 2.52: Update to version 2.62
Mitigation Miele Professional PG 85 series PG8527 version 2.54: Update to version 2.64
Mitigation Miele Professional PG 85 series PG8528 version 2.02: Update to version 2.12
Mitigation Miele Professional PG 85 series PG8528 version 2.51: Update to version 2.61
Mitigation Miele Professional PG 85 series PG8528 version 2.52: Update to version 2.62
Mitigation Miele Professional PG 85 series PG8528 version 2.54: Update to version 2.64
Mitigation Miele Professional PG 85 series PG8535 version 1.00: Update to version 1.10
Mitigation Miele Professional PG 85 series PG8535 version 1.04: Update to version 1.14
Vendor Fix Miele Professional PG 85 series PG8536 version 1.10: Update to version 1.20
Vendor Fix Miele Professional PG 85 series PG8536 version 1.14: Update to version 1.24
Mitigation Miele Professional issued a press release addressing this vulnerability on March 29, 2017, which can be found here: https://www.miele.de/en/m/miele-admits-communicat…
References
Acknowledgments
Schneider & Wulf Jens Regel
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Jens Regel"
        ],
        "organization": "Schneider \u0026 Wulf",
        "summary": "disclosing this vulnerability without ICS-CERT coordination"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "summary",
        "text": "Jens Regel of Schneider \u0026 Wulf publicly disclosed this vulnerability without ICS-CERT coordination.",
        "title": "Summary"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "CISAservicedesk@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-138-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-138-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-138-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-138-01"
      }
    ],
    "title": "ICSA-17-138-01_Miele Professional PG 85 Series",
    "tracking": {
      "current_release_date": "2017-05-18T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA USCert CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-17-138-01",
      "initial_release_date": "2017-05-18T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2017-05-18T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-17-138-01 Miele Professional PG 85 Series"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.00 | 1.04",
                "product": {
                  "name": "PG8535 version: 1.00 and 1.04",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "PG8535 version"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.02 | 2.51 2.52 | 2.54",
                "product": {
                  "name": "PG8527 version: 2.02 2.51 2.52 and 2.54",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "PG8527 version"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.02 | 2.51 2.52 | 2.54",
                "product": {
                  "name": "PG8528 version: 2.02 2.51 2.52 and 2.54",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "PG8528 version"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.10 | 1.14",
                "product": {
                  "name": "PG8536 version: 1.10 and 1.14",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "PG8536 version"
          }
        ],
        "category": "vendor",
        "name": "Miele Professional"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-7240",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The path traversal vulnerability has been identified, which may allow a remote attacker to access sensitive information by using special elements in the pathname to resolve to a location outside of a restricted directory.CVE-2017-7240 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Miele Professional issued patches for this vulnerability on May 4, 2017. Miele Professional is in the process of contacting all affected users via registered mail.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Users of affected machines can contact Miele Professional at 1-800-991-9380 to schedule service for a software update, which must be performed by a Miele Professional technician.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8527 version 2.02: Update to version 2.12",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8527 version 2.51: Update to version 2.61",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8527 version 2.52: Update to version 2.62",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8527 version 2.54: Update to version 2.64",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8528 version 2.02: Update to version 2.12",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8528 version 2.51: Update to version 2.61",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8528 version 2.52: Update to version 2.62",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8528 version 2.54: Update to version 2.64",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8535 version 1.00: Update to version 1.10",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional PG 85 series PG8535 version 1.04: Update to version 1.14",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Miele Professional PG 85 series PG8536 version 1.10: Update to version 1.20",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Miele Professional PG 85 series PG8536 version 1.14: Update to version 1.24",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Miele Professional issued a press release addressing this vulnerability on March 29, 2017, which can be found here:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ],
          "url": "https://www.miele.de/en/m/miele-admits-communication-glitch-4072.htm"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        }
      ],
      "title": "CVE-2017-7240"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.