cnvd-2017-23006
Vulnerability from cnvd
Title
多款PDQ产品权限获取漏洞
Description
PDQ Manufacturing LaserWash G5等都是美国PDQ Manufacturing公司的汽车自动清洗设备。web-server是其中的一个Web服务器。 多款PDQ产品中的web-server存在安全漏洞，由于程序未能验证身份验证信息是否正确。攻击者可利用该漏洞获取系统的访问权限，发布命令，影响系统的正常运行。
Severity
高
Patch Name
多款PDQ产品权限获取漏洞的补丁
Patch Description
PDQ Manufacturing LaserWash G5等都是美国PDQ Manufacturing公司的汽车自动清洗设备。web-server是其中的一个Web服务器。 多款PDQ产品中的web-server存在安全漏洞，由于程序未能验证身份验证信息是否正确。攻击者可利用该漏洞获取系统的访问权限，发布命令，影响系统的正常运行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： http://www.pdqinc.com/

Reference
https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03
Impacted products
Name
['PDQ Manufacturing LaserWash G5', 'PDQ Manufacturing LaserWash G5 S', 'PDQ Manufacturing LaserWash M5', 'PDQ Manufacturing LaserWash 360', 'PDQ Manufacturing LaserWash 360 Plus', 'PDQ Manufacturing LaserWash AutoXpress', 'PDQ Manufacturing LaserWash AutoExpress Plus', 'PDQ Manufacturing LaserJet', 'PDQ Manufacturing ProTouch Tandem', 'PDQ Manufacturing ProTouch ICON', 'PDQ Manufacturing ProTouch AutoGloss']
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-9630"
    }
  },
  "description": "PDQ Manufacturing LaserWash G5\u7b49\u90fd\u662f\u7f8e\u56fdPDQ Manufacturing\u516c\u53f8\u7684\u6c7d\u8f66\u81ea\u52a8\u6e05\u6d17\u8bbe\u5907\u3002web-server\u662f\u5176\u4e2d\u7684\u4e00\u4e2aWeb\u670d\u52a1\u5668\u3002\r\n\r\n\u591a\u6b3ePDQ\u4ea7\u54c1\u4e2d\u7684web-server\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u8eab\u4efd\u9a8c\u8bc1\u4fe1\u606f\u662f\u5426\u6b63\u786e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u7cfb\u7edf\u7684\u8bbf\u95ee\u6743\u9650\uff0c\u53d1\u5e03\u547d\u4ee4\uff0c\u5f71\u54cd\u7cfb\u7edf\u7684\u6b63\u5e38\u8fd0\u884c\u3002",
  "discovererName": "Billy Rios and Jonathan Butts of WhiteScope and Terry McCorkle",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://www.pdqinc.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-23006",
  "openTime": "2017-08-26",
  "patchDescription": "PDQ Manufacturing LaserWash G5\u7b49\u90fd\u662f\u7f8e\u56fdPDQ Manufacturing\u516c\u53f8\u7684\u6c7d\u8f66\u81ea\u52a8\u6e05\u6d17\u8bbe\u5907\u3002web-server\u662f\u5176\u4e2d\u7684\u4e00\u4e2aWeb\u670d\u52a1\u5668\u3002\r\n\r\n\u591a\u6b3ePDQ\u4ea7\u54c1\u4e2d\u7684web-server\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u8eab\u4efd\u9a8c\u8bc1\u4fe1\u606f\u662f\u5426\u6b63\u786e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u7cfb\u7edf\u7684\u8bbf\u95ee\u6743\u9650\uff0c\u53d1\u5e03\u547d\u4ee4\uff0c\u5f71\u54cd\u7cfb\u7edf\u7684\u6b63\u5e38\u8fd0\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3ePDQ\u4ea7\u54c1\u6743\u9650\u83b7\u53d6\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "PDQ Manufacturing LaserWash G5",
      "PDQ Manufacturing LaserWash G5 S",
      "PDQ Manufacturing LaserWash M5",
      "PDQ Manufacturing LaserWash 360",
      "PDQ Manufacturing LaserWash 360 Plus",
      "PDQ Manufacturing LaserWash AutoXpress",
      "PDQ Manufacturing LaserWash AutoExpress Plus",
      "PDQ Manufacturing LaserJet",
      "PDQ Manufacturing ProTouch Tandem",
      "PDQ Manufacturing ProTouch ICON",
      "PDQ Manufacturing ProTouch AutoGloss"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03",
  "serverity": "\u9ad8",
  "submitTime": "2017-08-03",
  "title": "\u591a\u6b3ePDQ\u4ea7\u54c1\u6743\u9650\u83b7\u53d6\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.