VAR-201708-1519
Vulnerability from variot - Updated: 2023-12-18 12:03A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass integrated client to potentially obtain credentials from the systems. Siemens SiPass integrated Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The SiPass server is a component of the SiPass centralized access control system that receives the client's connection for communication. Siemens SiPass integrated is prone to the following security vulnerabilities: 1. An authentication-bypass vulnerability 2. A privilege-escalation vulnerability 3. A man-in-the-middle security bypass vulnerability 4. An information-disclosure vulnerability An attacker may leverage these issues to disclose sensitive information, perform certain unauthorized actions by conducting a man-in-the-middle attack, gain unauthorized access or elevated privileges. Versions prior to SiPass integrated 2.70 are vulnerable. An attacker could exploit this vulnerability to obtain certificates on the system
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1519",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sipass integrated",
"scope": "lte",
"trust": 1.0,
"vendor": "siemens",
"version": "2.65"
},
{
"model": "sipass integrated",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "2.70"
},
{
"model": "sipass integrated",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "2.70"
},
{
"model": "sipass integrated",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "2.65"
},
{
"model": "sipass integrated mp2.6",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sipass integrated mp2.5",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sipass integrated mp2.4",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sipass integrated",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "2.70"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sipass integrated",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:sipass_integrated:*:sp2:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.65",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9942"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens",
"sources": [
{
"db": "BID",
"id": "99578"
}
],
"trust": 0.3
},
"cve": "CVE-2017-9942",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 2.1,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-9942",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2017-14601",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "47137c94-f064-4aa1-96c4-9cad2593f752",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-118145",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-9942",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-9942",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-14601",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-604",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-118145",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "VULHUB",
"id": "VHN-118145"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass integrated client to potentially obtain credentials from the systems. Siemens SiPass integrated Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The SiPass server is a component of the SiPass centralized access control system that receives the client\u0027s connection for communication. Siemens SiPass integrated is prone to the following security vulnerabilities:\n1. An authentication-bypass vulnerability\n2. A privilege-escalation vulnerability\n3. A man-in-the-middle security bypass vulnerability\n4. An information-disclosure vulnerability\nAn attacker may leverage these issues to disclose sensitive information, perform certain unauthorized actions by conducting a man-in-the-middle attack, gain unauthorized access or elevated privileges. \nVersions prior to SiPass integrated 2.70 are vulnerable. An attacker could exploit this vulnerability to obtain certificates on the system",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "VULHUB",
"id": "VHN-118145"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9942",
"trust": 3.6
},
{
"db": "SIEMENS",
"id": "SSA-339433",
"trust": 2.6
},
{
"db": "BID",
"id": "99578",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2017-14601",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-604",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-17-194-01",
"trust": 0.3
},
{
"db": "IVD",
"id": "47137C94-F064-4AA1-96C4-9CAD2593F752",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-118145",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "VULHUB",
"id": "VHN-118145"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"id": "VAR-201708-1519",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "VULHUB",
"id": "VHN-118145"
}
],
"trust": 1.48787876
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
}
]
},
"last_update_date": "2023-12-18T12:03:28.419000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-339433",
"trust": 0.8,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf"
},
{
"title": "Siemens SiPass integrated credentials to obtain patches for vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/98174"
},
{
"title": "Siemens SiPass integrated Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71718"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-255",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-118145"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "NVD",
"id": "CVE-2017-9942"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/99578"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9942"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9942"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-194-01"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "VULHUB",
"id": "VHN-118145"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"db": "VULHUB",
"id": "VHN-118145"
},
{
"db": "BID",
"id": "99578"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-15T00:00:00",
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"date": "2017-07-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"date": "2017-08-08T00:00:00",
"db": "VULHUB",
"id": "VHN-118145"
},
{
"date": "2017-07-13T00:00:00",
"db": "BID",
"id": "99578"
},
{
"date": "2017-09-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"date": "2017-08-08T00:29:00.477000",
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"date": "2017-07-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-14601"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-118145"
},
{
"date": "2017-07-13T00:00:00",
"db": "BID",
"id": "99578"
},
{
"date": "2017-09-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-006974"
},
{
"date": "2019-10-09T23:30:53.673000",
"db": "NVD",
"id": "CVE-2017-9942"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens SiPass integrated Credential acquisition vulnerability",
"sources": [
{
"db": "IVD",
"id": "47137c94-f064-4aa1-96c4-9cad2593f752"
},
{
"db": "CNVD",
"id": "CNVD-2017-14601"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-604"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…