Vulnerability-Lookup

CNVD-2015-04977

Vulnerability from cnvd - Published: 2015-07-28

Title

Eaton Cooper Power Systems ProView中间人攻击漏洞

Description

Eaton Cooper Power Systems ProView是美国Eaton公司的一套电力保护系统。 Eaton Cooper Power Systems ProView 4.0 5.0之前的5.0版本11 on Form 6 controls Idea IdeaPLUS relays generates TCP initial sequence number values linearly存在中间人攻击漏洞，允许远程攻击者可通过预测ISN值利用该漏洞实施中间人攻击，伪造TCP会话。

Severity

高

Patch Name

Eaton Cooper Power Systems ProView中间人攻击漏洞的补丁

Patch Description

Formal description

用户可联系供应商获得补丁信息： http://www.eaton.com

Reference

https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01

Impacted products

Name
['Eaton Corporation Cooper Power Systems ProView 4.0', 'Eaton Corporation Cooper Power Systems ProView 5.0(<5.0 11)']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "75936"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-9196"
    }
  },
  "description": "Eaton Cooper Power Systems ProView\u662f\u7f8e\u56fdEaton\u516c\u53f8\u7684\u4e00\u5957\u7535\u529b\u4fdd\u62a4\u7cfb\u7edf\u3002\r\n\r\nEaton Cooper Power Systems ProView 4.0 5.0\u4e4b\u524d\u76845.0\u7248\u672c11 on Form 6 controls Idea IdeaPLUS relays generates TCP initial sequence number values linearly\u5b58\u5728\u4e2d\u95f4\u4eba\u653b\u51fb\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u9884\u6d4bISN\u503c\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bd\u4e2d\u95f4\u4eba\u653b\u51fb\uff0c\u4f2a\u9020TCP\u4f1a\u8bdd\u3002",
  "discovererName": "Dr. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www.eaton.com",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-04977",
  "openTime": "2015-07-28",
  "patchDescription": "Eaton Cooper Power Systems ProView\u662f\u7f8e\u56fdEaton\u516c\u53f8\u7684\u4e00\u5957\u7535\u529b\u4fdd\u62a4\u7cfb\u7edf\u3002 \r\n\r\nEaton Cooper Power Systems ProView 4.0 5.0\u4e4b\u524d\u76845.0\u7248\u672c11 on Form 6 controls Idea IdeaPLUS relays generates TCP initial sequence number values linearly\u5b58\u5728\u4e2d\u95f4\u4eba\u653b\u51fb\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u9884\u6d4bISN\u503c\u5229\u7528\u8be5\u6f0f\u6d1e\u5b9e\u65bd\u4e2d\u95f4\u4eba\u653b\u51fb\uff0c\u4f2a\u9020TCP\u4f1a\u8bdd\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Eaton Cooper Power Systems ProView\u4e2d\u95f4\u4eba\u653b\u51fb\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Eaton Corporation Cooper Power Systems ProView 4.0",
      "Eaton Corporation Cooper Power Systems ProView 5.0(\u003c5.0 11)"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01",
  "serverity": "\u9ad8",
  "submitTime": "2015-07-23",
  "title": "Eaton Cooper Power Systems ProView\u4e2d\u95f4\u4eba\u653b\u51fb\u6f0f\u6d1e"
}

CVE-2014-9196 (GCVE-0-2014-9196)

Vulnerability from cvelistv5 – Published: 2015-07-20 01:00 – Updated: 2025-09-05 21:11

Title

Eaton’s Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet

Summary

Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.

Severity

No CVSS data available.

CWE

CWE-342

Assigner

icscert icscert root

References

4 references

URL	Tags
http://www.securityfocus.com/bid/75936	vdb-entryx_refsource_BID
https://www.cisa.gov/news-events/ics-advisories/i…
https://www.eaton.com/cybersecurity
https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01	x_refsource_MISCx_transferred

Impacted products

2 products

Vendor	Product	Version
Eaton’s Cooper Power Systems	Series Form 6	Affected: Pro View 4.0 , ≤ Pro View 5.0 (custom)
Eaton’s Cooper Power Systems	Idea/IdeaPLUS relays	Affected: Pro View 4.0 , ≤ Pro View 5.0 (custom)

Date Public

2015-07-16 06:00

Credits

Dr. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a research project partially sponsored by the Georgia Tech National Electric Energy Testing Research and Applications Center (NEETRAC)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:24.315Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "75936",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75936"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Series Form 6",
          "vendor": "Eaton\u2019s Cooper Power Systems",
          "versions": [
            {
              "lessThanOrEqual": "Pro View 5.0",
              "status": "affected",
              "version": "Pro View 4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Idea/IdeaPLUS relays",
          "vendor": "Eaton\u2019s Cooper Power Systems",
          "versions": [
            {
              "lessThanOrEqual": "Pro View 5.0",
              "status": "affected",
              "version": "Pro View 4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dr. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a research project partially sponsored by the Georgia Tech National Electric Energy Testing Research and Applications Center (NEETRAC)"
        }
      ],
      "datePublic": "2015-07-16T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eEaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.\u003c/p\u003e"
            }
          ],
          "value": "Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-342",
              "description": "CWE-342",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T21:11:15.864Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "75936",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75936"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-006-01"
        },
        {
          "url": "https://www.eaton.com/cybersecurity"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eEaton\u2019s Cooper Power Systems division has developed ProView 5.0 \nRevision 11 software that mitigates this vulnerability, and the Form 6 \ncontrol version was released on June 12, 2015. Idea/IdeaPLUS relay \nProView software versions began to be posted on June 30, 2015. \nProView 5.0 Revision 11 will be compatible with any hardware and \nfirmware Versions 5.0 and higher. Versions below 5.0 may be updated with\n the appropriate and corresponding hardware upgrades. Information on how\n to obtain and install these available remedies is available at:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.cooperindustries.com/content/public/en/power_systems/resources/securitysupport.html\"\u003ehttp://www.cooperindustries.com/content/public/en/power_systems/resources/securitysupport.html\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eFor additional technical information, please contact Eaton\u2019s Cooper Power Systems at:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.eaton.com/cybersecurity\"\u003ehttps://www.eaton.com/cybersecurity\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Eaton\u2019s Cooper Power Systems division has developed ProView 5.0 \nRevision 11 software that mitigates this vulnerability, and the Form 6 \ncontrol version was released on June 12, 2015. Idea/IdeaPLUS relay \nProView software versions began to be posted on June 30, 2015. \nProView 5.0 Revision 11 will be compatible with any hardware and \nfirmware Versions 5.0 and higher. Versions below 5.0 may be updated with\n the appropriate and corresponding hardware upgrades. Information on how\n to obtain and install these available remedies is available at:\n\n\n http://www.cooperindustries.com/content/public/en/power_systems/resources/securitysupport.html \n\n\nFor additional technical information, please contact Eaton\u2019s Cooper Power Systems at:\n\n\n https://www.eaton.com/cybersecurity"
        }
      ],
      "source": {
        "advisory": "ICSA-15-006-01",
        "discovery": "EXTERNAL"
      },
      "title": "Eaton\u2019s Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo authentication mechanism was used for new socket connections to \nSCADA protocol listening ports on the Form 6 control and Idea/IdeaPLUS \nrelays. The effects of exploiting this vulnerability are the same as the\n effects of an attacker connecting directly to the control or network \nand listening for or initiating a new session, without exploiting any \nvulnerabilities. This underscores the importance of deploying network \nsegmentation and isolation on the control system network. By ensuring \nthat controls are not accessible from external networks and that \nappropriate physical security measures are provided at network access \npoints, risks associated with this vulnerability are greatly minimized.\u003c/p\u003e\n\u003cp\u003eEaton\u2019s Cooper Power Systems recommends that asset owners using these\n products take the proper steps to ensure system wide defense-in-depth \nstrategies, as outlined in Eaton\u2019s whitepaper WP152002EN. This \nwhitepaper can be downloaded at:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.eaton.com/content/dam/eaton/products/industrialcontrols-drives-automation-sensors/c441-motor-insight-motor-protection-relays/cyber-security-white-paper-wp152002en.pdf\"\u003ehttps://www.eaton.com/content/dam/eaton/products/industrialcontrols-drives-automation-sensors/c441-motor-insight-motor-protection-relays/cyber-security-white-paper-wp152002en.pdf\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "No authentication mechanism was used for new socket connections to \nSCADA protocol listening ports on the Form 6 control and Idea/IdeaPLUS \nrelays. The effects of exploiting this vulnerability are the same as the\n effects of an attacker connecting directly to the control or network \nand listening for or initiating a new session, without exploiting any \nvulnerabilities. This underscores the importance of deploying network \nsegmentation and isolation on the control system network. By ensuring \nthat controls are not accessible from external networks and that \nappropriate physical security measures are provided at network access \npoints, risks associated with this vulnerability are greatly minimized.\n\n\nEaton\u2019s Cooper Power Systems recommends that asset owners using these\n products take the proper steps to ensure system wide defense-in-depth \nstrategies, as outlined in Eaton\u2019s whitepaper WP152002EN. This \nwhitepaper can be downloaded at:\n\n\n https://www.eaton.com/content/dam/eaton/products/industrialcontrols-drives-automation-sensors/c441-motor-insight-motor-protection-relays/cyber-security-white-paper-wp152002en.pdf"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-9196",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "75936",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75936"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-9196",
    "datePublished": "2015-07-20T01:00:00.000Z",
    "dateReserved": "2014-12-02T00:00:00.000Z",
    "dateUpdated": "2025-09-05T21:11:15.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2015-04977

CVE-2014-9196 (GCVE-0-2014-9196)

Tags

Sightings

Nomenclature

Related by attack behaviour