CVE-2017-5145 - OpenCVE

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Carlosgavazzi	Vmu-c Em Vmu-c Em Firmware Vmu-c Pv Vmu-c Pv Firmware

Configuration 1 [-]

AND

cpe:2.3:o:carlosgavazzi:vmu-c_em_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:carlosgavazzi:vmu-c_em:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:carlosgavazzi:vmu-c_pv_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:carlosgavazzi:vmu-c_pv:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/95411
https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2017-02-13T21:00:00

Updated: 2024-08-05T14:55:34.927Z

Reserved: 2017-01-03T00:00:00

Link: CVE-2017-5145

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2017-02-13T21:59:02.550

Modified: 2017-02-24T13:29:19.640

Link: CVE-2017-5145

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Carlo Gavazzi VMU-C EM and VMU-C PV", "vendor": "n/a", "versions": [{"status": "affected", "version": "Carlo Gavazzi VMU-C EM and VMU-C PV"}]}], "datePublic": "2017-02-13T00:00:00", "descriptions": [{"lang": "en", "value": "An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration."}], "problemTypes": [{"descriptions": [{"description": "Carlo Gavazzi VMU-C EM and VMU-C PV csrf", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-02-14T10:57:01", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"name": "95411", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/95411"}, {"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2017-5145", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Carlo Gavazzi VMU-C EM and VMU-C PV", "version": {"version_data": [{"version_value": "Carlo Gavazzi VMU-C EM and VMU-C PV"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Carlo Gavazzi VMU-C EM and VMU-C PV csrf"}]}]}, "references": {"reference_data": [{"name": "95411", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95411"}, {"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:55:34.927Z"}, "title": "CVE Program Container", "references": [{"name": "95411", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/95411"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2017-5145", "datePublished": "2017-02-13T21:00:00", "dateReserved": "2017-01-03T00:00:00", "dateUpdated": "2024-08-05T14:55:34.927Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:carlosgavazzi:vmu-c_em_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "87350035-E65E-4A46-8572-8039A6266D1D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:carlosgavazzi:vmu-c_em:-:*:*:*:*:*:*:*", "matchCriteriaId": "D57DACE2-2D99-4952-B15C-3E106886ABD3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:carlosgavazzi:vmu-c_pv_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "43AB7FE5-E55D-4096-9DA3-241299899FEF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:carlosgavazzi:vmu-c_pv:-:*:*:*:*:*:*:*", "matchCriteriaId": "E1E6B643-2FBD-4C8B-A498-8D0BD071505B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration."}, {"lang": "es", "value": "Se ha descubierto un problema en Carlo Gavazzi VMU-C EM anterior a la versi\u00f3n de firmware A11_U05 y VMU-C PV anterior al firmware Versi\u00f3n A17. La explotaci\u00f3n exitosa de esta vulnerabilidad de CSRF puede permitir la ejecuci\u00f3n de acciones no autorizadas en el dispositivo, tales como cambios de par\u00e1metro de configuraci\u00f3n y guardado de configuraci\u00f3n modificada."}], "id": "CVE-2017-5145", "lastModified": "2017-02-24T13:29:19.640", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-13T21:59:02.550", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/95411"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}