VAR-201708-1518
Vulnerability from variot - Updated: 2023-12-18 12:03A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker in a Man-in-the-Middle position between the SiPass integrated server and SiPass integrated clients to read or modify the network communication. Siemens SiPass integrated Contains an access control vulnerability.Information may be obtained and information may be altered. The SiPass server is a component of the SiPass centralized access control system that receives the client's connection for communication. Siemens SiPass integrated is prone to the following security vulnerabilities: 1. An authentication-bypass vulnerability 2. A privilege-escalation vulnerability 3. A man-in-the-middle security bypass vulnerability 4. An information-disclosure vulnerability An attacker may leverage these issues to disclose sensitive information, perform certain unauthorized actions by conducting a man-in-the-middle attack, gain unauthorized access or elevated privileges. Versions prior to SiPass integrated 2.70 are vulnerable. An attacker could exploit this vulnerability to read and alter network communications
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1518",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sipass integrated",
"scope": "lte",
"trust": 1.0,
"vendor": "siemens",
"version": "2.65"
},
{
"model": "sipass integrated",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "2.70"
},
{
"model": "sipass integrated",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "2.70"
},
{
"model": "sipass integrated",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "2.65"
},
{
"model": "sipass integrated mp2.6",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sipass integrated mp2.5",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sipass integrated mp2.4",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sipass integrated",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "2.70"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sipass integrated",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:sipass_integrated:*:sp2:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.65",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9941"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens",
"sources": [
{
"db": "BID",
"id": "99578"
}
],
"trust": 0.3
},
"cve": "CVE-2017-9941",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-9941",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "CNVD-2017-14602",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-118144",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.4,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-9941",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-9941",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-14602",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-605",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-118144",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "VULHUB",
"id": "VHN-118144"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker in a Man-in-the-Middle position between the SiPass integrated server and SiPass integrated clients to read or modify the network communication. Siemens SiPass integrated Contains an access control vulnerability.Information may be obtained and information may be altered. The SiPass server is a component of the SiPass centralized access control system that receives the client\u0027s connection for communication. Siemens SiPass integrated is prone to the following security vulnerabilities:\n1. An authentication-bypass vulnerability\n2. A privilege-escalation vulnerability\n3. A man-in-the-middle security bypass vulnerability\n4. An information-disclosure vulnerability\nAn attacker may leverage these issues to disclose sensitive information, perform certain unauthorized actions by conducting a man-in-the-middle attack, gain unauthorized access or elevated privileges. \nVersions prior to SiPass integrated 2.70 are vulnerable. An attacker could exploit this vulnerability to read and alter network communications",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"db": "VULHUB",
"id": "VHN-118144"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9941",
"trust": 3.6
},
{
"db": "SIEMENS",
"id": "SSA-339433",
"trust": 2.6
},
{
"db": "BID",
"id": "99578",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-201707-605",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-14602",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-17-194-01",
"trust": 0.3
},
{
"db": "IVD",
"id": "776376B5-C94B-4524-9A3A-ECD13C2DFE59",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-118144",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "VULHUB",
"id": "VHN-118144"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"id": "VAR-201708-1518",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "VULHUB",
"id": "VHN-118144"
}
],
"trust": 1.48787876
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"db": "CNVD",
"id": "CNVD-2017-14602"
}
]
},
"last_update_date": "2023-12-18T12:03:28.306000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-339433",
"trust": 0.8,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf"
},
{
"title": "Siemens SiPass integrated patch for unauthorized operating vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/98175"
},
{
"title": "Siemens SiPass integrated Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71719"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-284",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-118144"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "NVD",
"id": "CVE-2017-9941"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/99578"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9941"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9941"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-194-01"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "VULHUB",
"id": "VHN-118144"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"db": "VULHUB",
"id": "VHN-118144"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-15T00:00:00",
"db": "IVD",
"id": "776376b5-c94b-4524-9a3a-ecd13c2dfe59"
},
{
"date": "2017-07-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"date": "2017-08-08T00:00:00",
"db": "VULHUB",
"id": "VHN-118144"
},
{
"date": "2017-07-13T00:00:00",
"db": "BID",
"id": "99578"
},
{
"date": "2017-09-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"date": "2017-08-08T00:29:00.447000",
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"date": "2017-07-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-14602"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-118144"
},
{
"date": "2017-07-13T00:00:00",
"db": "BID",
"id": "99578"
},
{
"date": "2017-09-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006973"
},
{
"date": "2019-10-09T23:30:53.567000",
"db": "NVD",
"id": "CVE-2017-9941"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens SiPass integrated Access control vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-006973"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-605"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…