VAR-201407-0540
Vulnerability from variot - Updated: 2023-12-18 12:30Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page. Supplementary information : CWE Vulnerability type by CWE-552: Files or Directories Accessible to External Parties ( Externally accessible file or directory ) Has been identified. http://cwe.mitre.org/data/definitions/552.htmlIf a third party accesses the password change page, authentication may be bypassed and administrative access may be obtained. Honeywell is a manufacturing company focused on automation control. An attacker could exploit this vulnerability to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. Vulnerabilities
CVSS 10 - INSECURE CREDENTIAL STORAGE (Pass the Hash) CVE-2015-7914
CVSS 10 - INSECURE TRANSMISSION OF CREDENTIALS CVE-2015-7915
CVSS 7.4 - CROSS-SITE SCRIPTING CVE-2015-7916
Other risk exposures
Undocumented default accounts
Note that default accounts with changeable passwords, even when those are undocumented and do not look as user accounts neither in interface or documentation, constitute a formal vulnerability. It is at worst a misconfiguration.
References (Source)
This advisory:
https://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/
ICS CERT:
https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01
Summary of the issues
In short \x96 By obtaining access to a system using undocumented accounts, it is possible to obtain a low privilege level.
By exploiting the fact that the cashed credentials used for the \x93remember me\x94 function of the web application employ the same encryption as the one used for protection of passwords included in backups, a user can elevate privileges to administrator level.
The backups also contain other encrypted configuration information which can further an attacker\x92s access to also affect for example email accounts used for notifications.
By accessing the system as an administrator, an attacker can obtain those credentials in plain text from the system as they are included in the configuration details, protected only by the use of \x93password\x94 field-types in the forms.
In essence this constitute a pass the hash vulnerability. Just as with https://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/ which used hashed inputs to generate secure transfer of credentials over non encrypted connections, applying the same protection scheme to its stored, and exposed, secrets.
Don\x92t do your own cryptography.
A bit more details, sufficient for the interested reader to recreate but not a straight forward guide, available at the provided references.
Martin Jartelius \x96 CSO \x96 Outpost24 John Stock \x96 Technology Program Director \x96 Outpost24
. After giving the market two extra months for patching and also contacting some of the affected national CERTs Outpost24 today released the vulnerability details for CVE-2014-2717. This vulnerability consists of a missing access restriction in combination with a flawed login function, resulting in something as exotic as a pass the hash vulnerability to authenticate with a SCADA system, giving administrative access.*
*TL;DR; The Honeywell Falcon (XLWeb Linux/Webserver) contains a vulnerability which allows anyone, even without knowing the username or password, to log in as an administrator in the system. Although information regarding the presence of the vulnerability has been available for a few months since its open disclosure by the ISC CERT to member organizations, there are multiple unpatched systems that remain exposed to the Internet. Outpost24 have waited for an airport we were aware of were affected to patch before releasing.
The more full information is available here; http://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/
References: https://ics-cert.us-cert.gov/advisories/ICSA-14-175-01 CVE-2014-2717
AFFECTED PRODUCTS The following Honeywell FALCON XLWeb controller versions are affected:
- FALCON Linux 2.04.01 or older
- FALCON XLWebExe 2.02.11 or older.
The impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture and product implementation.
The affected products, FALCON XLWeb controllers, are web-based SCADA systems. According to Honeywell, FALCON XLWeb controllers are deployed across several industries including critical manufacturing, energy and wastewater systems among others. According to Honeywell, the affected controllers are used by customers primarily in Europe and the Middle East.
Outpost24 would like to direct a thank you to Honeywell and ICS CERT for their fast work in resolving the problems, and we also completely share the vendors recommendation that SCADA systems already in the first place should not be internet facing. The vendor have been a pleasure to work with and have taken every care to resolve the issue timely.
Martin Jartelius CSO Outpost24 www.outpost24.com
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0540",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "falcon xlweb linux controller",
"scope": "lte",
"trust": 1.0,
"vendor": "honeywell",
"version": "2.04.01"
},
{
"model": "falcon xlweb xlwebexe",
"scope": "lte",
"trust": 1.0,
"vendor": "honeywell",
"version": "2.02.11"
},
{
"model": "falcon linux",
"scope": "lte",
"trust": 0.8,
"vendor": "honeywell",
"version": "2.04.01"
},
{
"model": "falcon xlwebexe",
"scope": "lte",
"trust": 0.8,
"vendor": "honeywell",
"version": "2.02.11"
},
{
"model": "falcon xlweb controllers",
"scope": "lte",
"trust": 0.6,
"vendor": "honeywell",
"version": "\u003c=2.02.11"
},
{
"model": "falcon xlweb linux controller",
"scope": "eq",
"trust": 0.6,
"vendor": "honeywell",
"version": "2.04.01"
},
{
"model": "falcon xlweb xlwebexe",
"scope": "eq",
"trust": 0.6,
"vendor": "honeywell",
"version": "2.02.11"
},
{
"model": "falcon xlwebexe",
"scope": "eq",
"trust": 0.3,
"vendor": "honeywell",
"version": "2.2.11"
},
{
"model": "falcon linux",
"scope": "eq",
"trust": 0.3,
"vendor": "honeywell",
"version": "2.4.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "falcon xlweb linux controller",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "falcon xlweb xlwebexe",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"db": "BID",
"id": "68837"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:honeywell:falcon_xlweb_linux_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.04.01",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:honeywell:falcon_xlweb_xlwebexe:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.02.11",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2717"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Martin Jartelius of Outpost24",
"sources": [
{
"db": "BID",
"id": "68837"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2717",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.6,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2014-2717",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-04617",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-2717",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2014-04617",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-597",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page. Supplementary information : CWE Vulnerability type by CWE-552: Files or Directories Accessible to External Parties ( Externally accessible file or directory ) Has been identified. http://cwe.mitre.org/data/definitions/552.htmlIf a third party accesses the password change page, authentication may be bypassed and administrative access may be obtained. Honeywell is a manufacturing company focused on automation control. An attacker could exploit this vulnerability to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. Vulnerabilities\n\n---------------\n\nCVSS 10 - INSECURE CREDENTIAL STORAGE (Pass the Hash) CVE-2015-7914\n\nCVSS 10 - INSECURE TRANSMISSION OF CREDENTIALS CVE-2015-7915\n\nCVSS 7.4 - CROSS-SITE SCRIPTING CVE-2015-7916\n\n \n\nOther risk exposures\n\n---------------\n\nUndocumented default accounts\n\n \n\nNote that default accounts with changeable passwords, even when those\nare undocumented and do not look as user accounts neither in interface\nor documentation, constitute a formal vulnerability. It is at worst a\nmisconfiguration. \n\n \n\nReferences (Source)\n\n---------------\n\nThis advisory:\n\nhttps://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/\n\n \n\nICS CERT:\n\nhttps://ics-cert.us-cert.gov/advisories/ICSA-16-033-01\n\n\nSummary of the issues\n---------------\nIn short \\x96 By obtaining access to a system using undocumented accounts,\nit is possible to obtain a low privilege level. \n\nBy exploiting the fact that the cashed credentials used for the\n\\x93remember me\\x94 function of the web application employ the same encryption\nas the one used for protection of passwords included in backups, a user\ncan elevate privileges to administrator level. \n\nThe backups also contain other encrypted configuration information which\ncan further an attacker\\x92s access to also affect for example email\naccounts used for notifications. \n\nBy accessing the system as an administrator, an attacker can obtain\nthose credentials in plain text from the system as they are included in\nthe configuration details, protected only by the use of \\x93password\\x94\nfield-types in the forms. \n\nIn essence this constitute a pass the hash vulnerability. Just as with\nhttps://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/\nwhich used hashed inputs to generate secure transfer of credentials over\nnon encrypted connections, applying the same protection scheme to its\nstored, and exposed, secrets. \n\n\nDon\\x92t do your own cryptography. \n\n \n\nA bit more details, sufficient for the interested reader to recreate but\nnot a straight forward guide, available at the provided references. \n\n \n\n \n\nMartin Jartelius \\x96 CSO \\x96 Outpost24\nJohn Stock \\x96 Technology Program Director \\x96 Outpost24\n\n\n\n. After giving the market two extra months for patching and also\ncontacting some of the affected national CERTs Outpost24 today released\nthe vulnerability details for CVE-2014-2717. \nThis vulnerability consists of a missing access restriction in\ncombination with a flawed login function, resulting in something as\nexotic as a pass the hash vulnerability to authenticate with a SCADA\nsystem, giving administrative access.*\n\n*TL;DR; The Honeywell Falcon (XLWeb Linux/Webserver) contains a\nvulnerability which allows anyone, even without knowing the username or\npassword, to log in as an administrator in the system. Although\ninformation regarding the presence of the vulnerability has been\navailable for a few months since its open disclosure by the ISC CERT to\nmember organizations, there are multiple unpatched systems that remain\nexposed to the Internet. Outpost24 have waited for an airport we were\naware of were affected to patch before releasing. \n\nThe more full information is available here;\nhttp://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/\n\nReferences:\nhttps://ics-cert.us-cert.gov/advisories/ICSA-14-175-01\nCVE-2014-2717\n\n\nAFFECTED PRODUCTS\nThe following Honeywell FALCON XLWeb controller versions are affected:\n\n * FALCON Linux 2.04.01 or older\n * FALCON XLWebExe 2.02.11 or older. \n\nThe impact to individual organizations depends on many factors that are\nunique to each organization. ICS-CERT recommends that organizations\nevaluate the impact of this vulnerability based on their operational\nenvironment, architecture and product implementation. \n\nThe affected products, FALCON XLWeb controllers, are web-based SCADA\nsystems. According to Honeywell, FALCON XLWeb controllers are deployed\nacross several industries including critical manufacturing, energy and\nwastewater systems among others. According to Honeywell, the affected\ncontrollers are used by customers primarily in Europe and the Middle East. \n\nOutpost24 would like to direct a thank you to Honeywell and ICS CERT for\ntheir fast work in resolving the problems, and we also completely share\nthe vendors recommendation that SCADA systems already in the first place\nshould not be internet facing. The vendor have been a pleasure to work\nwith and have taken every care to resolve the issue timely. \n\n\nMartin Jartelius\nCSO\nOutpost24\nwww.outpost24.com\n\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"db": "BID",
"id": "68837"
},
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "135615"
},
{
"db": "PACKETSTORM",
"id": "128510"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2717",
"trust": 3.7
},
{
"db": "ICS CERT",
"id": "ICSA-14-175-01",
"trust": 3.4
},
{
"db": "BID",
"id": "68837",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2014-04617",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201407-597",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2FE3DDE-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "ICS CERT",
"id": "ICSA-16-033-01",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135615",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128510",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"db": "BID",
"id": "68837"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"db": "PACKETSTORM",
"id": "135615"
},
{
"db": "PACKETSTORM",
"id": "128510"
},
{
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
]
},
"id": "VAR-201407-0540",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
}
]
},
"last_update_date": "2023-12-18T12:30:04.521000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://honeywell.com/pages/home.aspx"
},
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "http://honeywell.com/sites/jp/pages/home.aspx"
},
{
"title": "Honeywell FALCON XLWeb Controllers authentication bypass vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/47883"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"db": "NVD",
"id": "CVE-2014-2717"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-175-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2717"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2717"
},
{
"trust": 0.3,
"url": "http://www.security.honeywell.com/"
},
{
"trust": 0.2,
"url": "https://www.outpost24.com/cve-2014-2717-attacking-the-honeywell-falcon-xlweb/"
},
{
"trust": 0.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-033-01"
},
{
"trust": 0.1,
"url": "https://www.outpost24.com/critical-scada-vulnerabilities-sauter-moduweb/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7916"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7915"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7914"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-2717"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"db": "BID",
"id": "68837"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"db": "PACKETSTORM",
"id": "135615"
},
{
"db": "PACKETSTORM",
"id": "128510"
},
{
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"db": "BID",
"id": "68837"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"db": "PACKETSTORM",
"id": "135615"
},
{
"db": "PACKETSTORM",
"id": "128510"
},
{
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-25T00:00:00",
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-07-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68837"
},
{
"date": "2014-07-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"date": "2016-02-05T15:55:55",
"db": "PACKETSTORM",
"id": "135615"
},
{
"date": "2014-10-01T18:22:22",
"db": "PACKETSTORM",
"id": "128510"
},
{
"date": "2014-07-24T14:55:07.363000",
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"date": "2014-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04617"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68837"
},
{
"date": "2014-07-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003563"
},
{
"date": "2014-07-25T13:52:32",
"db": "NVD",
"id": "CVE-2014-2717"
},
{
"date": "2014-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-597"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Honeywell FALCON XLWeb Controllers Authentication Bypass Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2fe3dde-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04617"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "68837"
}
],
"trust": 0.3
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…