9.8crit
CVE-2017-14728
An authentication bypass was found in an unknown area of the SiteOmat source code.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
6.4%
percentile 94%
Public exploits
0
none known
Summary
An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction (EPSS)
6.41% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-798 Use of Hard-coded Credentials
References
- orpak.com /allproducts/siteomat-station-controller-sw/ · x_refsource_MISC, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-19-122-01 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/108167 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-14728
- NVD: CVE-2017-14728
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.