VAR-201711-0760
Vulnerability from variot - Updated: 2023-12-18 12:57An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into clicking on a malicious link. The SM-2556 communication module is a protocol component for LAN/WAN communication with a Fast Ethernet interface that can be connected to the SICAM1703 and SICAMRTU substation controllers. Multiple Siemens SICAM RTU Products are prone to multiple security vulnerabilities. Attackers can exploit these issues to obtain sensitive information, to execute arbitrary code or arbitrary HTML or script code in the browser of an unsuspecting user within the context of the affected application. This can allow the attacker to steal cookie-based authentication credentials and aid in further attacks. Siemens SICAM RTUs is a substation controller of Siemens (Siemens) in Germany. SM-2556 COM Modules is used in one of the communication modules for LAN/WAN. Products using the following firmware are affected: ENOS00; ERAC00; ETA2; ETLS00; MODi00; DNPi00. SEC Consult Vulnerability Lab Security Advisory < 20171114-0 > ======================================================================= title: Authentication bypass, cross-site scripting & code execution product: Siemens SICAM RTUs SM-2556 COM Modules (firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00 and DNPi00 vulnerable version: FW 1549 Revision 07 fixed version: none, see Workaround section below CVE number: CVE-2017-12737 (authentication bypass) CVE-2017-12738 (XSS) CVE-2017-12739 (web server) impact: critical homepage: www.siemens.com found: 2017-08-17 by: SEC Consult Vulnerability Lab
An integrated part of SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich
https://www.sec-consult.com
=======================================================================
Vendor description:
"Siemens is a global powerhouse focusing on the areas of electrification, automation and digitalization. One of the world's largest producers of energy-efficient, resource-saving technologies, Siemens is a leading supplier of systems for power generation and transmission as well as medical diagnosis."
Source: https://www.siemens.com/global/en/home/company/about.html
Business recommendation:
SEC Consult recommends not to use this device in production until a thorough security review has been performed by security professionals and all identified issues have been resolved. The device must not be accessible from untrusted networks.
Vulnerability overview/description:
1) Authentication Bypass (client-side "authentication" enforcement) The web interface (TCP port 80) suffers from an authentication bypass vulnerability that allows unauthenticated attackers to access arbitray functionality and information (i.e. password lists) available through the webserver.
2) Reflected Cross-Site Scripting The web interface provides a "ping" functionality. This form is vulnerable to reflected cross-site-scripting because of missing input handling and output encoding.
3) Outdated Webserver (GoAhead) The used webserver version contains known weaknesses.
Proof of concept:
1) Authentication Bypass Use a browser which has JavaScript disabled ("Authentication" checks are performed client-side) and open legitimate URLs directly.
Examples: http:///start.asp http:///pwliste.asp http:///goform/webforms_readmem?start_addr=0&length=100
2) Reflected Cross-Site Scripting All parameters in "webforms_ping" are vulnerable to reflected XSS: http:///goform/webforms_ping?ip_address=1.1.1.com%3Cscript%3Ealert(%27XSS%20proof-of-concept%27)%3C/script%3E1&length_data=32&count_pings=4&timeout=1
3) Outdated Webserver The used version of "GoAhead" webserver is 2.1.7 (released in Oct. 2003) This version has known vulnerabilities:
http://aluigi.altervista.org/adv/goahead-adv3.txt https://web.archive.org/web/20080314153252/http:/data.goahead.com:80/Software/Webserver/2.1.8/release.htm#bug-with-urls-like-asp
Vulnerable / tested versions:
SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00 and DNPi00 (FW 1549 Revision 07)
Vendor contact timeline:
2017-09-25: Encrypted advisory sent to Siemens ProductCERT 2017-10-02: Requesting status update. 2017-10-09: Vendor states that the "affected device is out of service" and provides workaround (disable webserver). They are "still assessing the next steps". 2017-11-02: Requesting status update. 2017-11-06: Siemens ProductCERT will reach out to development team and keep us posted. 2017-11-08: Siemens ProductCERT prepares advisory. 2017-11-08: Asking about planned release date. 2017-11-13: Siemens ProductCERT provides planned release date (2017-11-14) 2017-11-14: Coordinated public release.
Solution:
No firmware update is available as the device is no longer supported by the vendor.
Workaround:
According to the vendor the webserver can be disabled to mitigate all the vulnerabilities documented in this advisory. The webserver is optional and only used for commissioning and debugging purposes.
The vendor published the following document for further information: https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf
Advisory URL:
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html
SEC Consult Vulnerability Lab
SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.
Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/career/index.html
Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/contact/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: research at sec-consult dot com Web: https://www.sec-consult.com Twitter: https://twitter.com/sec_consult
EOF SEC Consult Vulnerability Lab / @2017
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201711-0760",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sm-2556",
"scope": "eq",
"trust": 2.4,
"vendor": "siemens",
"version": "dnpi00"
},
{
"model": "sm-2556",
"scope": "eq",
"trust": 2.4,
"vendor": "siemens",
"version": "enos00"
},
{
"model": "sm-2556",
"scope": "eq",
"trust": 2.4,
"vendor": "siemens",
"version": "erac00"
},
{
"model": "sm-2556",
"scope": "eq",
"trust": 2.4,
"vendor": "siemens",
"version": "eta2"
},
{
"model": "sm-2556",
"scope": "eq",
"trust": 2.4,
"vendor": "siemens",
"version": "etls00"
},
{
"model": "sm-2556",
"scope": "eq",
"trust": 2.4,
"vendor": "siemens",
"version": "modi00"
},
{
"model": "sicam rtus sm-2556 com modules",
"scope": null,
"trust": 0.6,
"vendor": "siemens",
"version": null
},
{
"model": "sicam rtus sm-2556 com modules modi00",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sicam rtus sm-2556 com modules etls00",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sicam rtus sm-2556 com modules eta2",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sicam rtus sm-2556 com modules erac00",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sicam rtus sm-2556 com modules enos00",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sicam rtus sm-2556 com modules dnpi00",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "dnpi00",
"scope": null,
"trust": 0.2,
"vendor": "sm 2556",
"version": null
},
{
"model": "enos00",
"scope": null,
"trust": 0.2,
"vendor": "sm 2556",
"version": null
},
{
"model": "erac00",
"scope": null,
"trust": 0.2,
"vendor": "sm 2556",
"version": null
},
{
"model": "eta2",
"scope": null,
"trust": 0.2,
"vendor": "sm 2556",
"version": null
},
{
"model": "etls00",
"scope": null,
"trust": 0.2,
"vendor": "sm 2556",
"version": null
},
{
"model": "modi00",
"scope": null,
"trust": 0.2,
"vendor": "sm 2556",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "BID",
"id": "101884"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sm-2556_firmware:erac00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:siemens:sm-2556_firmware:enos00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:siemens:sm-2556_firmware:eta2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:siemens:sm-2556_firmware:etls00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:siemens:sm-2556_firmware:modi00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:siemens:sm-2556_firmware:dnpi00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sm-2556:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12738"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SEC Consult Vulnerability Lab.",
"sources": [
{
"db": "BID",
"id": "101884"
}
],
"trust": 0.3
},
"cve": "CVE-2017-12738",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-12738",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-33870",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "b3325462-db5e-456e-9987-16be80e22808",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-103290",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2017-12738",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12738",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2017-33870",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201711-557",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-103290",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "VULHUB",
"id": "VHN-103290"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into clicking on a malicious link. The SM-2556 communication module is a protocol component for LAN/WAN communication with a Fast Ethernet interface that can be connected to the SICAM1703 and SICAMRTU substation controllers. Multiple Siemens SICAM RTU Products are prone to multiple security vulnerabilities. \nAttackers can exploit these issues to obtain sensitive information, to execute arbitrary code or arbitrary HTML or script code in the browser of an unsuspecting user within the context of the affected application. This can allow the attacker to steal cookie-based authentication credentials and aid in further attacks. Siemens SICAM RTUs is a substation controller of Siemens (Siemens) in Germany. SM-2556 COM Modules is used in one of the communication modules for LAN/WAN. Products using the following firmware are affected: ENOS00; ERAC00; ETA2; ETLS00; MODi00; DNPi00. SEC Consult Vulnerability Lab Security Advisory \u003c 20171114-0 \u003e\n=======================================================================\n title: Authentication bypass, cross-site scripting \u0026 code\n execution\n product: Siemens SICAM RTUs SM-2556 COM Modules\n (firmware variants ENOS00, ERAC00, ETA2, ETLS00,\n MODi00 and DNPi00\n vulnerable version: FW 1549 Revision 07\n fixed version: none, see Workaround section below\n CVE number: CVE-2017-12737 (authentication bypass)\n CVE-2017-12738 (XSS)\n CVE-2017-12739 (web server)\n impact: critical\n homepage: www.siemens.com\n found: 2017-08-17\n by: SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult\n Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow\n Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Siemens is a global powerhouse focusing on the areas of electrification,\nautomation and digitalization. One of the world\u0027s largest producers of\nenergy-efficient, resource-saving technologies, Siemens is a leading supplier\nof systems for power generation and transmission as well as medical diagnosis.\"\n\nSource: https://www.siemens.com/global/en/home/company/about.html\n\n\nBusiness recommendation:\n------------------------\nSEC Consult recommends not to use this device in production until a thorough\nsecurity review has been performed by security professionals and all\nidentified issues have been resolved. The device must not be accessible from\nuntrusted networks. \n\n\nVulnerability overview/description:\n-----------------------------------\n1) Authentication Bypass (client-side \"authentication\" enforcement)\nThe web interface (TCP port 80) suffers from an authentication bypass\nvulnerability that allows unauthenticated attackers to access arbitray\nfunctionality and information (i.e. password lists) available through\nthe webserver. \n\n\n2) Reflected Cross-Site Scripting\nThe web interface provides a \"ping\" functionality. This form is\nvulnerable to reflected cross-site-scripting because of missing input\nhandling and output encoding. \n\n\n3) Outdated Webserver (GoAhead)\nThe used webserver version contains known weaknesses. \n\n\nProof of concept:\n-----------------\n1) Authentication Bypass\nUse a browser which has JavaScript disabled (\"Authentication\" checks are\nperformed client-side) and open legitimate URLs directly. \n\nExamples:\nhttp://\u003chostname\u003e/start.asp\nhttp://\u003chostname\u003e/pwliste.asp\nhttp://\u003chostname\u003e/goform/webforms_readmem?start_addr=0\u0026length=100\n\n\n2) Reflected Cross-Site Scripting\nAll parameters in \"webforms_ping\" are vulnerable to reflected XSS:\nhttp://\u003chostname\u003e/goform/webforms_ping?ip_address=1.1.1.com%3Cscript%3Ealert(%27XSS%20proof-of-concept%27)%3C/script%3E1\u0026length_data=32\u0026count_pings=4\u0026timeout=1\n\n\n3) Outdated Webserver\nThe used version of \"GoAhead\" webserver is 2.1.7 (released in Oct. 2003)\nThis version has known vulnerabilities:\n\nhttp://aluigi.altervista.org/adv/goahead-adv3.txt\nhttps://web.archive.org/web/20080314153252/http:/data.goahead.com:80/Software/Webserver/2.1.8/release.htm#bug-with-urls-like-asp\n\n\n\nVulnerable / tested versions:\n-----------------------------\nSM-2556 COM Modules with the firmware variants ENOS00, ERAC00,\nETA2, ETLS00, MODi00 and DNPi00\n(FW 1549 Revision 07)\n\n\nVendor contact timeline:\n------------------------\n2017-09-25: Encrypted advisory sent to Siemens ProductCERT\n2017-10-02: Requesting status update. \n2017-10-09: Vendor states that the \"affected device is out of service\"\n and provides workaround (disable webserver). They are\n \"still assessing the next steps\". \n2017-11-02: Requesting status update. \n2017-11-06: Siemens ProductCERT will reach out to development team and keep us\n posted. \n2017-11-08: Siemens ProductCERT prepares advisory. \n2017-11-08: Asking about planned release date. \n2017-11-13: Siemens ProductCERT provides planned release date (2017-11-14)\n2017-11-14: Coordinated public release. \n\n\nSolution:\n---------\nNo firmware update is available as the device is no longer supported by\nthe vendor. \n\n\nWorkaround:\n-----------\nAccording to the vendor the webserver can be disabled to mitigate all\nthe vulnerabilities documented in this advisory. \nThe webserver is optional and only used for commissioning and debugging\npurposes. \n\nThe vendor published the following document for further information:\nhttps://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf\n\n\nAdvisory URL:\n-------------\nhttps://www.sec-consult.com/en/vulnerability-lab/advisories/index.html\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\n\nSEC Consult\nBangkok - Berlin - Linz - Luxembourg - Montreal - Moscow\nKuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It\nensures the continued knowledge gain of SEC Consult in the field of network\nand application security to stay ahead of the attacker. The SEC Consult\nVulnerability Lab supports high-quality penetration testing and the evaluation\nof new offensive and defensive technologies for our customers. Hence our\ncustomers obtain the most current information about vulnerabilities and valid\nrecommendation about the risk profile of new technologies. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your application https://www.sec-consult.com/en/career/index.html\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local offices https://www.sec-consult.com/en/contact/index.html\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: research at sec-consult dot com\nWeb: https://www.sec-consult.com\nTwitter: https://twitter.com/sec_consult\n\n\nEOF SEC Consult Vulnerability Lab / @2017\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "BID",
"id": "101884"
},
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "VULHUB",
"id": "VHN-103290"
},
{
"db": "PACKETSTORM",
"id": "144982"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12738",
"trust": 3.7
},
{
"db": "SIEMENS",
"id": "SSA-164516",
"trust": 2.7
},
{
"db": "ICS CERT",
"id": "ICSA-17-320-02",
"trust": 1.7
},
{
"db": "BID",
"id": "101884",
"trust": 1.4
},
{
"db": "CNNVD",
"id": "CNNVD-201711-557",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-33870",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179",
"trust": 0.8
},
{
"db": "IVD",
"id": "B3325462-DB5E-456E-9987-16BE80E22808",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-103290",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144982",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "VULHUB",
"id": "VHN-103290"
},
{
"db": "BID",
"id": "101884"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "PACKETSTORM",
"id": "144982"
},
{
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"id": "VAR-201711-0760",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "VULHUB",
"id": "VHN-103290"
}
],
"trust": 1.775
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
}
]
},
"last_update_date": "2023-12-18T12:57:10.779000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-164516",
"trust": 0.8,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf"
},
{
"title": "Patch for SICAMRTUSM-2556COM module cross-site scripting vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/106363"
},
{
"title": "Siemens SICAM RTUs SM-2556 COM Modules Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=76396"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103290"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "NVD",
"id": "CVE-2017-12738"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf"
},
{
"trust": 1.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-320-02"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/101884"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12738"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12738"
},
{
"trust": 0.3,
"url": "http://www.siemens.com/"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"trust": 0.1,
"url": "http://\u003chostname\u003e/goform/webforms_ping?ip_address=1.1.1.com%3cscript%3ealert(%27xss%20proof-of-concept%27)%3c/script%3e1\u0026length_data=32\u0026count_pings=4\u0026timeout=1"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com/en/career/index.html"
},
{
"trust": 0.1,
"url": "http://\u003chostname\u003e/goform/webforms_readmem?start_addr=0\u0026length=100"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12739"
},
{
"trust": 0.1,
"url": "https://web.archive.org/web/20080314153252/http:/data.goahead.com:80/software/webserver/2.1.8/release.htm#bug-with-urls-like-asp"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12737"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com/en/contact/index.html"
},
{
"trust": 0.1,
"url": "https://twitter.com/sec_consult"
},
{
"trust": 0.1,
"url": "https://www.siemens.com/global/en/home/company/about.html"
},
{
"trust": 0.1,
"url": "http://aluigi.altervista.org/adv/goahead-adv3.txt"
},
{
"trust": 0.1,
"url": "http://\u003chostname\u003e/pwliste.asp"
},
{
"trust": 0.1,
"url": "http://\u003chostname\u003e/start.asp"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "VULHUB",
"id": "VHN-103290"
},
{
"db": "BID",
"id": "101884"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "PACKETSTORM",
"id": "144982"
},
{
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"db": "VULHUB",
"id": "VHN-103290"
},
{
"db": "BID",
"id": "101884"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"db": "PACKETSTORM",
"id": "144982"
},
{
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-11-15T00:00:00",
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"date": "2017-11-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"date": "2017-11-15T00:00:00",
"db": "VULHUB",
"id": "VHN-103290"
},
{
"date": "2017-11-14T00:00:00",
"db": "BID",
"id": "101884"
},
{
"date": "2017-12-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"date": "2017-11-14T15:17:47",
"db": "PACKETSTORM",
"id": "144982"
},
{
"date": "2017-11-15T08:29:00.267000",
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"date": "2017-11-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-11-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-33870"
},
{
"date": "2017-11-30T00:00:00",
"db": "VULHUB",
"id": "VHN-103290"
},
{
"date": "2017-12-19T22:37:00",
"db": "BID",
"id": "101884"
},
{
"date": "2017-12-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-010179"
},
{
"date": "2017-11-30T19:46:43.937000",
"db": "NVD",
"id": "CVE-2017-12738"
},
{
"date": "2017-11-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SICAM RTU SM-2556 COM Module Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "IVD",
"id": "b3325462-db5e-456e-9987-16be80e22808"
},
{
"db": "CNVD",
"id": "CNVD-2017-33870"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201711-557"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…