7.5

CVE-2017-16241

Exploit
Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00) enables remote attackers to execute door controller commands (e.g., lock, unlock, add ID card value) by sending unauthenticated requests to the affected devices via Serial over TCP/IP, as demonstrated by a Ud command.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Amag ≫ En-1dbc Firmware Version 03.60
   Amag ≫ En-1dbc Version -
Amag ≫ Std Firmware Version 03.60
   Amag ≫ Std Version -
Amag ≫ En-2dbc Firmware Version 03.60
   Amag ≫ En-2dbc Version -
Amag ≫ Std Firmware Version 01.00
   Amag ≫ Std Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2% 0.781
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://github.com/lixmk/Concierge
Exploit
https://hushcon.com/schedule.html
Not Applicable
https://www.secureworks.com/research/advisory-2017-001
Third Party Advisory