Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Campbell Scientific
CVE-2024-5434 (GCVE-0-2024-5434)
Vulnerability from nvd – Published: 2024-05-28 18:43 – Updated: 2024-08-01 21:11
VLAI
Title
Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC
Summary
The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-261 - Weak Encoding for Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Campbell Scientific | CSI Web Server and RTMC |
Affected:
CSI Web Server 1.6
Affected: RTMC 5.0 |
|
| campbellsci | csi_web_server |
Affected:
1.6
cpe:2.3:a:campbellsci:csi_web_server:1.6:*:*:*:*:*:*:* |
|
| campbellsci | rtmc |
Affected:
5.0
cpe:2.3:a:campbellsci:rtmc:5.0:*:*:*:*:*:*:* |
Date Public
2024-05-28 18:19
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:campbellsci:csi_web_server:1.6:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "csi_web_server",
"vendor": "campbellsci",
"versions": [
{
"status": "affected",
"version": "1.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:campbellsci:rtmc:5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rtmc",
"vendor": "campbellsci",
"versions": [
{
"status": "affected",
"version": "5.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-28T20:02:29.975410Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:02:06.311Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.752Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CSI Web Server and RTMC",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "CSI Web Server 1.6"
},
{
"status": "affected",
"version": "RTMC 5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Patrick K. Sheehan, Grant Hume, and Donald Macary reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-05-28T18:19:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access.\u003c/span\u003e"
}
],
"value": "The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-261",
"description": "CWE-261 Weak Encoding for Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-28T18:43:07.150Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCampbell Scientific recommends users to update to the version.\u003cbr\u003eFor user of CSI Web Server update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/csi-web-server-patch\"\u003eCSI Web Server 1.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 5 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-5-patch\"\u003eRTMC Pro 5.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 4 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-patch\"\u003eRTMC Pro 4.x patch\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eContact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/contact\"\u003eCampbell Scientific\u003c/a\u003e\u0026nbsp;for more details.\u003c/p\u003e"
}
],
"value": "Campbell Scientific recommends users to update to the version.\nFor user of CSI Web Server update to the most recent CSI Web Server 1.x patch https://www.campbellsci.com/downloads/csi-web-server-patch \n\nFor users of RTMC Pro 5 update to the most recent RTMC Pro 5.x patch https://www.campbellsci.com/downloads/rtmc-pro-5-patch \n\nFor users of RTMC Pro 4 update to the most recent RTMC Pro 4.x patch https://www.campbellsci.com/downloads/rtmc-pro-patch .\n\nContact Campbell Scientific https://www.campbellsci.com/contact \u00a0for more details."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5434",
"datePublished": "2024-05-28T18:43:07.150Z",
"dateReserved": "2024-05-28T13:59:14.696Z",
"dateUpdated": "2024-08-01T21:11:12.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5433 (GCVE-0-2024-5433)
Vulnerability from nvd – Published: 2024-05-28 18:39 – Updated: 2024-08-01 21:11
VLAI
Title
Path Traversal in Campbell Scientific CSI Web Server and RTMC
Summary
The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Campbell Scientific | CSI Web Server and RTMC |
Affected:
CSI Web Server 1.6
Affected: RTMC 5.0 |
Date Public
2024-05-28 18:19
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:52:58.731269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:01:50.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.744Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CSI Web Server and RTMC",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "CSI Web Server 1.6"
},
{
"status": "affected",
"version": "RTMC 5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Patrick K. Sheehan, Grant Hume, and Donald Macary reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-05-28T18:19:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.\u003c/span\u003e"
}
],
"value": "The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-28T18:39:48.285Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCampbell Scientific recommends users to update to the version.\u003cbr\u003eFor user of CSI Web Server update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/csi-web-server-patch\"\u003eCSI Web Server 1.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 5 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-5-patch\"\u003eRTMC Pro 5.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 4 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-patch\"\u003eRTMC Pro 4.x patch\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eContact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/contact\"\u003eCampbell Scientific\u003c/a\u003e\u0026nbsp;for more details.\u003c/p\u003e"
}
],
"value": "Campbell Scientific recommends users to update to the version.\nFor user of CSI Web Server update to the most recent CSI Web Server 1.x patch https://www.campbellsci.com/downloads/csi-web-server-patch \n\nFor users of RTMC Pro 5 update to the most recent RTMC Pro 5.x patch https://www.campbellsci.com/downloads/rtmc-pro-5-patch \n\nFor users of RTMC Pro 4 update to the most recent RTMC Pro 4.x patch https://www.campbellsci.com/downloads/rtmc-pro-patch .\n\nContact Campbell Scientific https://www.campbellsci.com/contact \u00a0for more details."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Path Traversal in Campbell Scientific CSI Web Server and RTMC",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5433",
"datePublished": "2024-05-28T18:39:48.285Z",
"dateReserved": "2024-05-28T13:59:13.434Z",
"dateUpdated": "2024-08-01T21:11:12.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-0321 (GCVE-0-2023-0321)
Vulnerability from nvd – Published: 2023-01-25 00:00 – Updated: 2025-03-27 20:09
VLAI
Title
Disclosure of Sensitive Information on Campbell Scientific Products
Summary
Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Campbell Scientific | CR6 |
Affected:
all version
|
|
| Campbell Scientific | CR300 |
Affected:
all version
|
|
| Campbell Scientific | CR800 |
Affected:
all version
|
|
| Campbell Scientific | CR1000 |
Affected:
all version
|
|
| Campbell Scientific | CR3000 |
Affected:
all version
|
Date Public
2023-01-17 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:10:55.177Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-0321",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-27T20:06:58.630452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-27T20:09:03.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CR6",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR300",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR800",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR1000",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR3000",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Carlos Antonini Cepeda"
}
],
"datePublic": "2023-01-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-25T00:00:00.000Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products"
},
{
"url": "https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html"
}
],
"source": {
"advisory": "INCIBE-2023-0017",
"defect": [
"INCIBE-2022-0040"
],
"discovery": "EXTERNAL"
},
"title": "Disclosure of Sensitive Information on Campbell Scientific Products",
"workarounds": [
{
"lang": "en",
"value": "HTTP can be disabled or secured through username/password, and Pakbus can be secured through the use of PakBus encryption key and/or PakBus/TCP password. Campbell Scientific offers a guide with instructions to maximize the security of all Internet connectivity of the affected devices (see more in the references)."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2023-0321",
"datePublished": "2023-01-25T00:00:00.000Z",
"dateReserved": "2023-01-16T00:00:00.000Z",
"dateUpdated": "2025-03-27T20:09:03.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5434 (GCVE-0-2024-5434)
Vulnerability from cvelistv5 – Published: 2024-05-28 18:43 – Updated: 2024-08-01 21:11
VLAI
Title
Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC
Summary
The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-261 - Weak Encoding for Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Campbell Scientific | CSI Web Server and RTMC |
Affected:
CSI Web Server 1.6
Affected: RTMC 5.0 |
|
| campbellsci | csi_web_server |
Affected:
1.6
cpe:2.3:a:campbellsci:csi_web_server:1.6:*:*:*:*:*:*:* |
|
| campbellsci | rtmc |
Affected:
5.0
cpe:2.3:a:campbellsci:rtmc:5.0:*:*:*:*:*:*:* |
Date Public
2024-05-28 18:19
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:campbellsci:csi_web_server:1.6:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "csi_web_server",
"vendor": "campbellsci",
"versions": [
{
"status": "affected",
"version": "1.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:campbellsci:rtmc:5.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rtmc",
"vendor": "campbellsci",
"versions": [
{
"status": "affected",
"version": "5.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-28T20:02:29.975410Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:02:06.311Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.752Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CSI Web Server and RTMC",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "CSI Web Server 1.6"
},
{
"status": "affected",
"version": "RTMC 5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Patrick K. Sheehan, Grant Hume, and Donald Macary reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-05-28T18:19:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access.\u003c/span\u003e"
}
],
"value": "The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-261",
"description": "CWE-261 Weak Encoding for Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-28T18:43:07.150Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCampbell Scientific recommends users to update to the version.\u003cbr\u003eFor user of CSI Web Server update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/csi-web-server-patch\"\u003eCSI Web Server 1.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 5 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-5-patch\"\u003eRTMC Pro 5.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 4 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-patch\"\u003eRTMC Pro 4.x patch\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eContact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/contact\"\u003eCampbell Scientific\u003c/a\u003e\u0026nbsp;for more details.\u003c/p\u003e"
}
],
"value": "Campbell Scientific recommends users to update to the version.\nFor user of CSI Web Server update to the most recent CSI Web Server 1.x patch https://www.campbellsci.com/downloads/csi-web-server-patch \n\nFor users of RTMC Pro 5 update to the most recent RTMC Pro 5.x patch https://www.campbellsci.com/downloads/rtmc-pro-5-patch \n\nFor users of RTMC Pro 4 update to the most recent RTMC Pro 4.x patch https://www.campbellsci.com/downloads/rtmc-pro-patch .\n\nContact Campbell Scientific https://www.campbellsci.com/contact \u00a0for more details."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5434",
"datePublished": "2024-05-28T18:43:07.150Z",
"dateReserved": "2024-05-28T13:59:14.696Z",
"dateUpdated": "2024-08-01T21:11:12.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5433 (GCVE-0-2024-5433)
Vulnerability from cvelistv5 – Published: 2024-05-28 18:39 – Updated: 2024-08-01 21:11
VLAI
Title
Path Traversal in Campbell Scientific CSI Web Server and RTMC
Summary
The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Campbell Scientific | CSI Web Server and RTMC |
Affected:
CSI Web Server 1.6
Affected: RTMC 5.0 |
Date Public
2024-05-28 18:19
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T16:52:58.731269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:01:50.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.744Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CSI Web Server and RTMC",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "CSI Web Server 1.6"
},
{
"status": "affected",
"version": "RTMC 5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Patrick K. Sheehan, Grant Hume, and Donald Macary reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-05-28T18:19:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.\u003c/span\u003e"
}
],
"value": "The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-28T18:39:48.285Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCampbell Scientific recommends users to update to the version.\u003cbr\u003eFor user of CSI Web Server update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/csi-web-server-patch\"\u003eCSI Web Server 1.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 5 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-5-patch\"\u003eRTMC Pro 5.x patch\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor users of RTMC Pro 4 update to the most recent \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/downloads/rtmc-pro-patch\"\u003eRTMC Pro 4.x patch\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eContact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.campbellsci.com/contact\"\u003eCampbell Scientific\u003c/a\u003e\u0026nbsp;for more details.\u003c/p\u003e"
}
],
"value": "Campbell Scientific recommends users to update to the version.\nFor user of CSI Web Server update to the most recent CSI Web Server 1.x patch https://www.campbellsci.com/downloads/csi-web-server-patch \n\nFor users of RTMC Pro 5 update to the most recent RTMC Pro 5.x patch https://www.campbellsci.com/downloads/rtmc-pro-5-patch \n\nFor users of RTMC Pro 4 update to the most recent RTMC Pro 4.x patch https://www.campbellsci.com/downloads/rtmc-pro-patch .\n\nContact Campbell Scientific https://www.campbellsci.com/contact \u00a0for more details."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Path Traversal in Campbell Scientific CSI Web Server and RTMC",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5433",
"datePublished": "2024-05-28T18:39:48.285Z",
"dateReserved": "2024-05-28T13:59:13.434Z",
"dateUpdated": "2024-08-01T21:11:12.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-0321 (GCVE-0-2023-0321)
Vulnerability from cvelistv5 – Published: 2023-01-25 00:00 – Updated: 2025-03-27 20:09
VLAI
Title
Disclosure of Sensitive Information on Campbell Scientific Products
Summary
Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Campbell Scientific | CR6 |
Affected:
all version
|
|
| Campbell Scientific | CR300 |
Affected:
all version
|
|
| Campbell Scientific | CR800 |
Affected:
all version
|
|
| Campbell Scientific | CR1000 |
Affected:
all version
|
|
| Campbell Scientific | CR3000 |
Affected:
all version
|
Date Public
2023-01-17 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:10:55.177Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-0321",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-27T20:06:58.630452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-27T20:09:03.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CR6",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR300",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR800",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR1000",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
},
{
"product": "CR3000",
"vendor": "Campbell Scientific",
"versions": [
{
"status": "affected",
"version": "all version"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Carlos Antonini Cepeda"
}
],
"datePublic": "2023-01-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contain sensitive information about the internal network. From factory defaults, the mentioned datalogges have HTTP and PakBus enabled. The devices, with the default configuration, allow this situation via the PakBus port. The exploitation of this vulnerability may allow an attacker to download, modify, and upload new configuration files."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-25T00:00:00.000Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe-cert.es/en/early-warning/ics-advisories/disclosure-sensitive-information-campbell-scientific-products"
},
{
"url": "https://www.hackplayers.com/2023/01/cve-2023-0321-info-sensible-campbell.html"
}
],
"source": {
"advisory": "INCIBE-2023-0017",
"defect": [
"INCIBE-2022-0040"
],
"discovery": "EXTERNAL"
},
"title": "Disclosure of Sensitive Information on Campbell Scientific Products",
"workarounds": [
{
"lang": "en",
"value": "HTTP can be disabled or secured through username/password, and Pakbus can be secured through the use of PakBus encryption key and/or PakBus/TCP password. Campbell Scientific offers a guide with instructions to maximize the security of all Internet connectivity of the affected devices (see more in the references)."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2023-0321",
"datePublished": "2023-01-25T00:00:00.000Z",
"dateReserved": "2023-01-16T00:00:00.000Z",
"dateUpdated": "2025-03-27T20:09:03.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}