Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2017-5705 (GCVE-0-2017-5705)
Vulnerability from cvelistv5
Published
2017-11-21 14:00
Modified
2024-09-17 03:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Elevation of Privilege
Summary
Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Intel Corporation | Manageability Engine |
Version: 11.0/11.5/11.6/11.7/11.10/11.20 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:11:48.723Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"name": "1039852",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039852"
},
{
"name": "101917",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101917"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Manageability Engine",
"vendor": "Intel Corporation",
"versions": [
{
"status": "affected",
"version": "11.0/11.5/11.6/11.7/11.10/11.20"
}
]
}
],
"datePublic": "2017-11-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-05-10T09:57:01",
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"name": "1039852",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039852"
},
{
"name": "101917",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101917"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@intel.com",
"DATE_PUBLIC": "2017-11-20T00:00:00",
"ID": "CVE-2017-5705",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Manageability Engine",
"version": {
"version_data": [
{
"version_value": "11.0/11.5/11.6/11.7/11.10/11.20"
}
]
}
}
]
},
"vendor_name": "Intel Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Elevation of Privilege"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://security.netapp.com/advisory/ntap-20171120-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"name": "1039852",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039852"
},
{
"name": "101917",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101917"
},
{
"name": "https://twitter.com/PTsecurity_UK/status/938447926128291842",
"refsource": "MISC",
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"name": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr",
"refsource": "CONFIRM",
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_17_73",
"refsource": "CONFIRM",
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"name": "https://www.asus.com/News/wzeltG5CjYaIwGJ0",
"refsource": "CONFIRM",
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"assignerShortName": "intel",
"cveId": "CVE-2017-5705",
"datePublished": "2017-11-21T14:00:00Z",
"dateReserved": "2017-02-01T00:00:00",
"dateUpdated": "2024-09-17T03:29:01.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2017-5705\",\"sourceIdentifier\":\"secure@intel.com\",\"published\":\"2017-11-21T14:29:00.290\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples desbordamientos de b\u00fafer en el kernel en Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 permiten que un atacante con acceso local al sistema ejecute c\u00f3digo arbitrario.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":7.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":3.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:intel:manageability_engine_firmware:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"411DC559-E8A9-4BC4-96C6-EA753E54543E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:intel:manageability_engine_firmware:11.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"559DF7F6-F649-4C57-893A-6775F07C31A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:intel:manageability_engine_firmware:11.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2380C5D8-8A58-4279-A3D9-7234C7B1D668\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:intel:manageability_engine_firmware:11.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39EB2D65-90F2-4866-A886-F64DB9C7D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:intel:manageability_engine_firmware:11.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69EF0C50-F104-47CE-89E7-BC37FE1A5717\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:intel:manageability_engine_firmware:11.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D764C7C-2C49-4149-9586-5D0140CE00FF\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/101917\",\"source\":\"secure@intel.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1039852\",\"source\":\"secure@intel.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf\",\"source\":\"secure@intel.com\"},{\"url\":\"https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr\",\"source\":\"secure@intel.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20171120-0001/\",\"source\":\"secure@intel.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/PTsecurity_UK/status/938447926128291842\",\"source\":\"secure@intel.com\"},{\"url\":\"https://www.asus.com/News/wzeltG5CjYaIwGJ0\",\"source\":\"secure@intel.com\"},{\"url\":\"https://www.synology.com/support/security/Synology_SA_17_73\",\"source\":\"secure@intel.com\"},{\"url\":\"http://www.securityfocus.com/bid/101917\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1039852\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20171120-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/PTsecurity_UK/status/938447926128291842\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.asus.com/News/wzeltG5CjYaIwGJ0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.synology.com/support/security/Synology_SA_17_73\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
cnvd-2017-37849
Vulnerability from cnvd
Title
Intel Manageability Engine缓冲区溢出漏洞
Description
Intel Manageability Engine英特尔管理引擎是Intel针对其桌面系列芯片组推出的一款热能管理驱动。
Intel Manageability Engine内核存在缓冲区溢出漏洞，允许本地攻击者利用漏洞提交特殊的请求，执行任意代码，提升权限。
Severity
高
VLAI Severity ?
Patch Name
Intel Manageability Engine缓冲区溢出漏洞的补丁
Patch Description
Intel Manageability Engine英特尔管理引擎是Intel针对其桌面系列芯片组推出的一款热能管理驱动。
Intel Manageability Engine内核存在缓冲区溢出漏洞，允许本地攻击者利用漏洞提交特殊的请求，执行任意代码，提升权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
用户可参考如下厂商提供的安全补丁以修复该漏洞： https://security.netapp.com/advisory/ntap-20171120-0001/
Reference
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr
Impacted products
| Name | ['Intel Manageability Engine 11.7', 'Intel Manageability Engine 11.6', 'Intel Manageability Engine 11.5', 'Intel Manageability Engine 11.20', 'Intel Manageability Engine 11.10', 'Intel Manageability Engine 11.0'] |
|---|
{
"bids": {
"bid": {
"bidNumber": "101917"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2017-5705"
}
},
"description": "Intel Manageability Engine\u82f1\u7279\u5c14\u7ba1\u7406\u5f15\u64ce\u662fIntel\u9488\u5bf9\u5176\u684c\u9762\u7cfb\u5217\u82af\u7247\u7ec4\u63a8\u51fa\u7684\u4e00\u6b3e\u70ed\u80fd\u7ba1\u7406\u9a71\u52a8\u3002\r\n\r\nIntel Manageability Engine\u5185\u6838\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5141\u8bb8\u672c\u5730\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u63d0\u5347\u6743\u9650\u3002",
"discovererName": "Mark Ermolov and Maxim Goryachy from Positive Technologies",
"formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttps://security.netapp.com/advisory/ntap-20171120-0001/",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2017-37849",
"openTime": "2017-12-25",
"patchDescription": "Intel Manageability Engine\u82f1\u7279\u5c14\u7ba1\u7406\u5f15\u64ce\u662fIntel\u9488\u5bf9\u5176\u684c\u9762\u7cfb\u5217\u82af\u7247\u7ec4\u63a8\u51fa\u7684\u4e00\u6b3e\u70ed\u80fd\u7ba1\u7406\u9a71\u52a8\u3002\r\n\r\nIntel Manageability Engine\u5185\u6838\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5141\u8bb8\u672c\u5730\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u63d0\u5347\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Intel Manageability Engine\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"Intel Manageability Engine 11.7",
"Intel Manageability Engine 11.6",
"Intel Manageability Engine 11.5",
"Intel Manageability Engine 11.20",
"Intel Manageability Engine 11.10",
"Intel Manageability Engine 11.0"
]
},
"referenceLink": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr",
"serverity": "\u9ad8",
"submitTime": "2017-11-22",
"title": "Intel Manageability Engine\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}
ICSA-18-060-01
Vulnerability from csaf_cisa
Published
2018-03-01 00:00
Modified
2018-04-19 00:00
Summary
ICSA-18-060-01_Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
Siemens ProductCERT reported the vulnerabilities to NCCIC.
Exploitability
No known public exploits specifically target these vulnerabilities.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting the vulnerabilities to NCCIC"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "summary",
"text": "Siemens ProductCERT reported the vulnerabilities to NCCIC.",
"title": "Summary"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "CISAservicedesk@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-18-060-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2018/icsa-18-060-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-18-060-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-060-01"
}
],
"title": "ICSA-18-060-01_Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)",
"tracking": {
"current_release_date": "2018-04-19T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA USCert CSAF Generator",
"version": "1"
}
},
"id": "ICSA-18-060-01",
"initial_release_date": "2018-03-01T00:00:00.000000Z",
"revision_history": [
{
"date": "2018-03-01T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-18-060-01 Siemens SIMATIC, SIMOTION, and SINUMERIK"
},
{
"date": "2018-04-19T00:00:00.000000Z",
"legacy_version": "A",
"number": "2",
"summary": "ICSA-18-060-01 Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-P WINXP: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-P WINXP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-C WINXP: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-C WINXP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 17.0 ?.10",
"product": {
"name": "SIMATIC IPC477D PRO: BIOS prior to V17.0?.10",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477D PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-C WIN7: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-C WIN7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC647D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC647D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC847D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC847D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC627C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC627C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-P WIN7: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-P WIN7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 11.8.50.3425 (ME) | \u003c R1.21.0 (BIOS)",
"product": {
"name": "SIMATIC IPC547G: ME prior to V11.8.50.3425 and BIOS prior to R1.21.0",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC547G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c S17.02.06.83.1",
"product": {
"name": "SIMOTION P320-4S: BIOS prior to S17.02.06.83.1",
"product_id": "CSAFPID-00010"
}
}
],
"category": "product_name",
"name": "SIMOTION P320-4S"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC647C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00011"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC647C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC Field-PG M3: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00012"
}
}
],
"category": "product_name",
"name": "SIMATIC Field-PG M3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 17.0 ?.10",
"product": {
"name": "SIMATIC IPC477D: BIOS prior to V17.0?.10",
"product_id": "CSAFPID-00013"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC677D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00014"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC677D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 18.01.06",
"product": {
"name": "SIMATIC Field-PG M4: BIOS prior to V18.01.06",
"product_id": "CSAFPID-00015"
}
}
],
"category": "product_name",
"name": "SIMATIC Field-PG M4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC627D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00016"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC627D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 23.01.03",
"product": {
"name": "SIMATIC ITP1000: BIOS prior to V23.01.03",
"product_id": "CSAFPID-00017"
}
}
],
"category": "product_name",
"name": "SIMATIC ITP1000"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 7.1.91.3272",
"product": {
"name": "SIMATIC IPC547D: ME prior to V7.1.91.3272",
"product_id": "CSAFPID-00018"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC547D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC847C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00019"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC847C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 22.01.04",
"product": {
"name": "SIMATIC Field-PG M5: BIOS prior to V22.01.04",
"product_id": "CSAFPID-00020"
}
}
],
"category": "product_name",
"name": "SIMATIC Field-PG M5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 21.01.07",
"product": {
"name": "SIMATIC IPC477E: BIOS prior to V21.01.07",
"product_id": "CSAFPID-00021"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 17.0 ?.10",
"product": {
"name": "SIMATIC IPC427D: BIOS prior to V17.0?.10",
"product_id": "CSAFPID-00022"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC427D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC827D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00023"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC827D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC HMI IPC677C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00024"
}
}
],
"category": "product_name",
"name": "SIMATIC HMI IPC677C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 21.01.07",
"product": {
"name": "SIMATIC IPC427E: BIOS prior to V21.01.07",
"product_id": "CSAFPID-00025"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC427E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC547E: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00026"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC547E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC827C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00027"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC827C"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-5705",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "Multiple buffer overflows could allow attackers to execute arbitrary code. Local access to the system is required to exploit this vulnerability. CVE-2017-5705, CVE-2017-5706, and CVE-2017-5707 have been assigned to these vulnerabilities. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on Industrial Security by Siemens",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
"product_ids": [
"CSAFPID-00015"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
"product_ids": [
"CSAFPID-00020"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
},
{
"category": "vendor_fix",
"details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00024"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
"product_ids": [
"CSAFPID-00022"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
"product_ids": [
"CSAFPID-00025"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477E: Update to V21.01.07 or higher, which can be located here",
"product_ids": [
"CSAFPID-00021"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
"product_ids": [
"CSAFPID-00018"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00026"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00016"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00011"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00027"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00023"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00019"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
"product_ids": [
"CSAFPID-00017"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
]
}
],
"title": "CVE-2017-5705"
},
{
"cve": "CVE-2017-5706",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "A buffer overflow could allow remote authenticated attackers to execute arbitrary code with extended privileges.CVE-2017-5712 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on Industrial Security by Siemens",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
"product_ids": [
"CSAFPID-00015"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
"product_ids": [
"CSAFPID-00020"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
},
{
"category": "vendor_fix",
"details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00024"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
"product_ids": [
"CSAFPID-00022"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
"product_ids": [
"CSAFPID-00025"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477E: Update to V21.01.07 or higher, which can be located here",
"product_ids": [
"CSAFPID-00021"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
"product_ids": [
"CSAFPID-00018"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00026"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00016"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00011"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00027"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00023"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00019"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
"product_ids": [
"CSAFPID-00017"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
}
],
"title": "CVE-2017-5706"
},
{
"cve": "CVE-2017-5707",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "Multiple privilege escalations could allow unauthenticated access to sensitive data.CVE-2017-5708, CVE-2017-5709, and CVE-2017-5710 have been assigned to these vulnerabilities. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on Industrial Security by Siemens",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
"product_ids": [
"CSAFPID-00015"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
"product_ids": [
"CSAFPID-00020"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
},
{
"category": "vendor_fix",
"details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00024"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
"product_ids": [
"CSAFPID-00022"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
"product_ids": [
"CSAFPID-00025"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477E: Update to V21.01.07 or higher, which can be located here",
"product_ids": [
"CSAFPID-00021"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
"product_ids": [
"CSAFPID-00018"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00026"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00016"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00011"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00027"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00023"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00019"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
"product_ids": [
"CSAFPID-00017"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
}
],
"title": "CVE-2017-5707"
}
]
}
icsa-18-060-01
Vulnerability from csaf_cisa
Published
2018-03-01 00:00
Modified
2018-04-19 00:00
Summary
ICSA-18-060-01_Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
Siemens ProductCERT reported the vulnerabilities to NCCIC.
Exploitability
No known public exploits specifically target these vulnerabilities.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting the vulnerabilities to NCCIC"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "summary",
"text": "Siemens ProductCERT reported the vulnerabilities to NCCIC.",
"title": "Summary"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "CISAservicedesk@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-18-060-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2018/icsa-18-060-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-18-060-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-060-01"
}
],
"title": "ICSA-18-060-01_Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)",
"tracking": {
"current_release_date": "2018-04-19T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA USCert CSAF Generator",
"version": "1"
}
},
"id": "ICSA-18-060-01",
"initial_release_date": "2018-03-01T00:00:00.000000Z",
"revision_history": [
{
"date": "2018-03-01T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-18-060-01 Siemens SIMATIC, SIMOTION, and SINUMERIK"
},
{
"date": "2018-04-19T00:00:00.000000Z",
"legacy_version": "A",
"number": "2",
"summary": "ICSA-18-060-01 Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-P WINXP: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-P WINXP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-C WINXP: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-C WINXP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 17.0 ?.10",
"product": {
"name": "SIMATIC IPC477D PRO: BIOS prior to V17.0?.10",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477D PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-C WIN7: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-C WIN7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC647D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC647D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC847D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC847D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC627C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC627C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SINUMERIK PCU50.5-P WIN7: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "SINUMERIK PCU50.5-P WIN7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 11.8.50.3425 (ME) | \u003c R1.21.0 (BIOS)",
"product": {
"name": "SIMATIC IPC547G: ME prior to V11.8.50.3425 and BIOS prior to R1.21.0",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC547G"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c S17.02.06.83.1",
"product": {
"name": "SIMOTION P320-4S: BIOS prior to S17.02.06.83.1",
"product_id": "CSAFPID-00010"
}
}
],
"category": "product_name",
"name": "SIMOTION P320-4S"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC647C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00011"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC647C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC Field-PG M3: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00012"
}
}
],
"category": "product_name",
"name": "SIMATIC Field-PG M3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 17.0 ?.10",
"product": {
"name": "SIMATIC IPC477D: BIOS prior to V17.0?.10",
"product_id": "CSAFPID-00013"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC677D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00014"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC677D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 18.01.06",
"product": {
"name": "SIMATIC Field-PG M4: BIOS prior to V18.01.06",
"product_id": "CSAFPID-00015"
}
}
],
"category": "product_name",
"name": "SIMATIC Field-PG M4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC627D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00016"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC627D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 23.01.03",
"product": {
"name": "SIMATIC ITP1000: BIOS prior to V23.01.03",
"product_id": "CSAFPID-00017"
}
}
],
"category": "product_name",
"name": "SIMATIC ITP1000"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 7.1.91.3272",
"product": {
"name": "SIMATIC IPC547D: ME prior to V7.1.91.3272",
"product_id": "CSAFPID-00018"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC547D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC847C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00019"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC847C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 22.01.04",
"product": {
"name": "SIMATIC Field-PG M5: BIOS prior to V22.01.04",
"product_id": "CSAFPID-00020"
}
}
],
"category": "product_name",
"name": "SIMATIC Field-PG M5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 21.01.07",
"product": {
"name": "SIMATIC IPC477E: BIOS prior to V21.01.07",
"product_id": "CSAFPID-00021"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC477E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 17.0 ?.10",
"product": {
"name": "SIMATIC IPC427D: BIOS prior to V17.0?.10",
"product_id": "CSAFPID-00022"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC427D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC827D: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00023"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC827D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC HMI IPC677C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00024"
}
}
],
"category": "product_name",
"name": "SIMATIC HMI IPC677C"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 21.01.07",
"product": {
"name": "SIMATIC IPC427E: BIOS prior to V21.01.07",
"product_id": "CSAFPID-00025"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC427E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 9.1.41.3024",
"product": {
"name": "SIMATIC IPC547E: ME prior to V9.1.41.3024",
"product_id": "CSAFPID-00026"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC547E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 6.2.61.3535",
"product": {
"name": "SIMATIC IPC827C: ME prior to V6.2.61.3535",
"product_id": "CSAFPID-00027"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC827C"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-5705",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "Multiple buffer overflows could allow attackers to execute arbitrary code. Local access to the system is required to exploit this vulnerability. CVE-2017-5705, CVE-2017-5706, and CVE-2017-5707 have been assigned to these vulnerabilities. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on Industrial Security by Siemens",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
"product_ids": [
"CSAFPID-00015"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
"product_ids": [
"CSAFPID-00020"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
},
{
"category": "vendor_fix",
"details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00024"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
"product_ids": [
"CSAFPID-00022"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
"product_ids": [
"CSAFPID-00025"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477E: Update to V21.01.07 or higher, which can be located here",
"product_ids": [
"CSAFPID-00021"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
"product_ids": [
"CSAFPID-00018"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00026"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00016"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00011"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00027"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00023"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00019"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
"product_ids": [
"CSAFPID-00017"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
]
}
],
"title": "CVE-2017-5705"
},
{
"cve": "CVE-2017-5706",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "A buffer overflow could allow remote authenticated attackers to execute arbitrary code with extended privileges.CVE-2017-5712 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on Industrial Security by Siemens",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
"product_ids": [
"CSAFPID-00015"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
"product_ids": [
"CSAFPID-00020"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
},
{
"category": "vendor_fix",
"details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00024"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
"product_ids": [
"CSAFPID-00022"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
"product_ids": [
"CSAFPID-00025"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477E: Update to V21.01.07 or higher, which can be located here",
"product_ids": [
"CSAFPID-00021"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
"product_ids": [
"CSAFPID-00018"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00026"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00016"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00011"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00027"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00023"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00019"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
"product_ids": [
"CSAFPID-00017"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
}
],
"title": "CVE-2017-5706"
},
{
"cve": "CVE-2017-5707",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "Multiple privilege escalations could allow unauthenticated access to sensitive data.CVE-2017-5708, CVE-2017-5709, and CVE-2017-5710 have been assigned to these vulnerabilities. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on Industrial Security by Siemens",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022",
"CSAFPID-00023",
"CSAFPID-00024",
"CSAFPID-00025",
"CSAFPID-00026",
"CSAFPID-00027"
],
"url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
"product_ids": [
"CSAFPID-00015"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
},
{
"category": "vendor_fix",
"details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
"product_ids": [
"CSAFPID-00020"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
},
{
"category": "vendor_fix",
"details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00024"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
"product_ids": [
"CSAFPID-00022"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
"product_ids": [
"CSAFPID-00025"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-00013"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC477E: Update to V21.01.07 or higher, which can be located here",
"product_ids": [
"CSAFPID-00021"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
"product_ids": [
"CSAFPID-00018"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00026"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
"product_ids": [
"CSAFPID-0009"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00016"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00011"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00014"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00027"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-00023"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-00019"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
},
{
"category": "vendor_fix",
"details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
},
{
"category": "vendor_fix",
"details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
"product_ids": [
"CSAFPID-00017"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
},
{
"category": "vendor_fix",
"details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
"product_ids": [
"CSAFPID-00012"
],
"url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
}
],
"title": "CVE-2017-5707"
}
]
}
fkie_cve-2017-5705
Vulnerability from fkie_nvd
Published
2017-11-21 14:29
Modified
2025-04-20 01:37
Severity ?
Summary
Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.
References
| URL | Tags | ||
|---|---|---|---|
| secure@intel.com | http://www.securityfocus.com/bid/101917 | Third Party Advisory, VDB Entry | |
| secure@intel.com | http://www.securitytracker.com/id/1039852 | Issue Tracking, Third Party Advisory, VDB Entry | |
| secure@intel.com | https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf | ||
| secure@intel.com | https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr | Issue Tracking, Vendor Advisory | |
| secure@intel.com | https://security.netapp.com/advisory/ntap-20171120-0001/ | Issue Tracking, Third Party Advisory | |
| secure@intel.com | https://twitter.com/PTsecurity_UK/status/938447926128291842 | ||
| secure@intel.com | https://www.asus.com/News/wzeltG5CjYaIwGJ0 | ||
| secure@intel.com | https://www.synology.com/support/security/Synology_SA_17_73 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/101917 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1039852 | Issue Tracking, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20171120-0001/ | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://twitter.com/PTsecurity_UK/status/938447926128291842 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.asus.com/News/wzeltG5CjYaIwGJ0 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.synology.com/support/security/Synology_SA_17_73 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| intel | manageability_engine_firmware | 11.0 | |
| intel | manageability_engine_firmware | 11.5 | |
| intel | manageability_engine_firmware | 11.6 | |
| intel | manageability_engine_firmware | 11.7 | |
| intel | manageability_engine_firmware | 11.10 | |
| intel | manageability_engine_firmware | 11.20 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:intel:manageability_engine_firmware:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "411DC559-E8A9-4BC4-96C6-EA753E54543E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:intel:manageability_engine_firmware:11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "559DF7F6-F649-4C57-893A-6775F07C31A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:intel:manageability_engine_firmware:11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2380C5D8-8A58-4279-A3D9-7234C7B1D668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:intel:manageability_engine_firmware:11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "39EB2D65-90F2-4866-A886-F64DB9C7D2FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:intel:manageability_engine_firmware:11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "69EF0C50-F104-47CE-89E7-BC37FE1A5717",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:intel:manageability_engine_firmware:11.20:*:*:*:*:*:*:*",
"matchCriteriaId": "3D764C7C-2C49-4149-9586-5D0140CE00FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code."
},
{
"lang": "es",
"value": "M\u00faltiples desbordamientos de b\u00fafer en el kernel en Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 permiten que un atacante con acceso local al sistema ejecute c\u00f3digo arbitrario."
}
],
"id": "CVE-2017-5705",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-21T14:29:00.290",
"references": [
{
"source": "secure@intel.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101917"
},
{
"source": "secure@intel.com",
"tags": [
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1039852"
},
{
"source": "secure@intel.com",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"source": "secure@intel.com",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"source": "secure@intel.com",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"source": "secure@intel.com",
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"source": "secure@intel.com",
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
},
{
"source": "secure@intel.com",
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101917"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1039852"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
}
],
"sourceIdentifier": "secure@intel.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
ghsa-rrhq-wvx3-p693
Vulnerability from github
Published
2022-05-14 03:24
Modified
2025-04-20 03:48
Severity ?
VLAI Severity ?
Details
Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2017-5705"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-21T14:29:00Z",
"severity": "HIGH"
},
"details": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.",
"id": "GHSA-rrhq-wvx3-p693",
"modified": "2025-04-20T03:48:53Z",
"published": "2022-05-14T03:24:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5705"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"type": "WEB",
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20171120-0001"
},
{
"type": "WEB",
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"type": "WEB",
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
},
{
"type": "WEB",
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101917"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039852"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
CERTFR-2017-AVI-423
Vulnerability from certfr_avis
Le 1er mai 2017 [1], une vulnérabilité concernant Intel AMT permettait à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges sur des machines comportant un modèle de processeur Intel habituellement utilisé par les entreprises.
Le 20 novembre 2017 [2][3], un article annonce l’identification de nouvelles vulnérabilités critiques dans IME et AMT pour les processeurs Intel. Les processeurs concernés correspondent autant à des modèles d’entreprise qu'à des modèles pour particuliers.
Intel propose un outil permettant de détecter les processeurs affectés par cette vulnérabilité [4].
L’exploitation de ces vulnérabilités permet à un attaquant ayant un accès local à la machine d’altérer l’intégrité de la chaîne de démarrage et d’exécuter du code arbitraire à l’insu du système d’exploitation, même lorsque la machine est éteinte.
Ces vulnérabilités concernent une vaste gamme de processeurs : des versions de processeurs récentes disponible pour les particuliers dont la vente commence début 2016, comme de plus anciens destinés aux entreprises datant de 2011.
A ce jour, il n’existe pas de code disponible publiquement exploitant ces vulnérabilités. Potentiellement, un tel code pourrait permettre :
- Une exécution de code arbitraire dans le contexte d’IME et, par conséquent, des modules basés dessus, tels que AMT ou PTT (Plateform Trust Technology) ;
- d’impacter les mécanismes d’attestation de validité de la machine, tel que la désactivation du Secure Boot, grâce à la compromission d’AMT ;
- de charger et exécuter du code arbitraire dans le contexte d’AMT, par exemple pour charger une session VNC à l’insu du système d’exploitation ;
- de récupérer des informations contenues dans la plateforme Intel PTT, telles que des clés de Bitlocker.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
- Intel Manageability Engine Firmware (IME) 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20
- Intel Server Platform Services (SPS) Firmware 4.0
- Intel Trusted Execution Engine (TXE) Firmware 3.0
On retrouve ces microgiciels dans les produits d'Intel suivants :
- Générations 6, 7 et 8 de la famille de processeur Intel Core
- Processeur Intel Xeon E3-1200 v5 et v6
- Processeur Intel Xeon Scalable
- Processeur Intel Xeon W
- Processeur Intel Atom C3000
- Processeur Apollo Lake Intel Atom série E3900
- Processeur Apollo Lake Intel Pentium
- Processeur Celeron séries N and J
Impacted products
| Vendor | Product | Description |
|---|
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [],
"affected_systems_content": "\u003cul\u003e \u003cli\u003eIntel Manageability Engine Firmware (IME) 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20\u003c/li\u003e \u003cli\u003eIntel Server Platform Services (SPS) Firmware 4.0\u003c/li\u003e \u003cli\u003eIntel Trusted Execution Engine (TXE) Firmware 3.0\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eOn retrouve ces microgiciels dans les produits d\u0027Intel suivants :\u003c/p\u003e \u003cul\u003e \u003cli\u003e\u00a0 G\u00e9n\u00e9rations 6, 7 et 8 de la famille de processeur Intel Core\u003c/li\u003e \u003cli\u003e\u00a0 Processeur Intel Xeon E3-1200 v5 et v6\u003c/li\u003e \u003cli\u003e\u00a0 Processeur Intel Xeon Scalable\u003c/li\u003e \u003cli\u003e\u00a0 Processeur Intel Xeon W\u003c/li\u003e \u003cli\u003e\u00a0 Processeur Intel Atom C3000\u003c/li\u003e \u003cli\u003e\u00a0 Processeur Apollo Lake Intel Atom s\u00e9rie E3900\u003c/li\u003e \u003cli\u003e\u00a0 Processeur Apollo Lake Intel Pentium\u003c/li\u003e \u003cli\u003e\u00a0 Processeur Celeron s\u00e9ries N and J\u003c/li\u003e \u003c/ul\u003e ",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-5705",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5705"
},
{
"name": "CVE-2017-5708",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5708"
},
{
"name": "CVE-2017-5710",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5710"
},
{
"name": "CVE-2017-5706",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5706"
},
{
"name": "CVE-2017-5712",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5712"
},
{
"name": "CVE-2017-5707",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5707"
},
{
"name": "CVE-2017-5709",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5709"
},
{
"name": "CVE-2017-5711",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5711"
}
],
"initial_release_date": "2017-11-21T00:00:00",
"last_revision_date": "2017-11-21T00:00:00",
"links": [
{
"title": "Outil de d\u00e9tection de la vuln\u00e9rabilit\u00e9 relatif au bulletin Intel SA-00086",
"url": "https://downloadcenter.intel.com/download/27150"
},
{
"title": "Avis CERTFR-2017-AVI-136",
"url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2017-AVI-136/"
},
{
"title": "Support Intel relatif au bulletin Intel SA-00086 pour la mise \u00e0 jour du logiciel Intel Management Engine",
"url": "https://www.intel.com/content/www/us/en/support/articles/000025619/software.html"
}
],
"reference": "CERTFR-2017-AVI-423",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2017-11-21T00:00:00.000000"
},
{
"description": "Version initiale",
"revision_date": "2017-11-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Le 1er mai 2017 \\[1\\], une vuln\u00e9rabilit\u00e9 concernant Intel AMT permettait\n\u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance\net une \u00e9l\u00e9vation de privil\u00e8ges sur des machines comportant un mod\u00e8le de\nprocesseur Intel habituellement utilis\u00e9 par les entreprises.\n\nLe 20 novembre 2017 \\[2\\]\\[3\\], un article annonce l\u2019identification de\nnouvelles vuln\u00e9rabilit\u00e9s critiques dans IME et AMT pour les processeurs\nIntel. Les processeurs concern\u00e9s correspondent autant \u00e0 des mod\u00e8les\nd\u2019entreprise qu\u0027\u00e0 des mod\u00e8les pour particuliers.\n\nIntel propose un outil permettant de d\u00e9tecter les processeurs affect\u00e9s\npar cette vuln\u00e9rabilit\u00e9 \\[4\\].\n\nL\u2019exploitation de ces vuln\u00e9rabilit\u00e9s permet \u00e0 un attaquant ayant un\nacc\u00e8s local \u00e0 la machine d\u2019alt\u00e9rer l\u2019int\u00e9grit\u00e9 de la cha\u00eene de d\u00e9marrage\net d\u2019ex\u00e9cuter du code arbitraire \u00e0 l\u2019insu du syst\u00e8me d\u2019exploitation,\nm\u00eame lorsque la machine est \u00e9teinte.\n\nCes vuln\u00e9rabilit\u00e9s concernent une vaste gamme de processeurs : des\nversions de processeurs r\u00e9centes disponible pour les particuliers dont\nla vente commence d\u00e9but 2016, comme de plus anciens destin\u00e9s aux\nentreprises datant de 2011.\n\nA ce jour, il n\u2019existe pas de code disponible publiquement exploitant\nces vuln\u00e9rabilit\u00e9s. Potentiellement, un tel code pourrait permettre :\n\n1. Une ex\u00e9cution de code arbitraire dans le contexte d\u2019IME et, par\n cons\u00e9quent, des modules bas\u00e9s dessus, tels que AMT ou PTT (Plateform\n Trust Technology) ;\n2. d\u2019impacter les m\u00e9canismes d\u2019attestation de validit\u00e9 de la machine,\n tel que la d\u00e9sactivation du Secure Boot, gr\u00e2ce \u00e0 la compromission\n d\u2019AMT ;\n3. de charger et ex\u00e9cuter du code arbitraire dans le contexte d\u2019AMT,\n par exemple pour charger une session VNC \u00e0 l\u2019insu du syst\u00e8me\n d\u2019exploitation ;\n4. de r\u00e9cup\u00e9rer des informations contenues dans la plateforme Intel\n PTT, telles que des cl\u00e9s de Bitlocker.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les microgiciels Intel",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00086 du 20 novembre 2017",
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
}
]
}
CERTFR-2018-AVI-095
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans SCADA les produits Siemens . Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Se r\u00e9f\u00e9rer aux avis du constructeur pour les syst\u00e8mes affect\u00e9s (cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-5705",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5705"
},
{
"name": "CVE-2017-5708",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5708"
},
{
"name": "CVE-2017-5710",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5710"
},
{
"name": "CVE-2017-5754",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5754"
},
{
"name": "CVE-2017-5706",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5706"
},
{
"name": "CVE-2017-5753",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5753"
},
{
"name": "CVE-2017-5712",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5712"
},
{
"name": "CVE-2017-5707",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5707"
},
{
"name": "CVE-2017-5715",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
},
{
"name": "CVE-2017-15361",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15361"
},
{
"name": "CVE-2017-5709",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5709"
},
{
"name": "CVE-2017-5711",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5711"
}
],
"initial_release_date": "2018-02-22T00:00:00",
"last_revision_date": "2018-02-22T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-095",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-02-22T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SCADA les produits\nSiemens . Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, une ex\u00e9cution de code\narbitraire et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans SCADA les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SCADA Siemens ssa-470231 du 22 f\u00e9vrier 2018",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SCADA Siemens ssa-168644 du 22 f\u00e9vrier 2018",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-168644.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 SCADA Siemens ssa-892715 du 22 f\u00e9vrier 2018",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
}
]
}
gsd-2017-5705
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2017-5705",
"description": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.",
"id": "GSD-2017-5705"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-5705"
],
"details": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.",
"id": "GSD-2017-5705",
"modified": "2023-12-13T01:21:13.207663Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@intel.com",
"DATE_PUBLIC": "2017-11-20T00:00:00",
"ID": "CVE-2017-5705",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Manageability Engine",
"version": {
"version_data": [
{
"version_value": "11.0/11.5/11.6/11.7/11.10/11.20"
}
]
}
}
]
},
"vendor_name": "Intel Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Elevation of Privilege"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://security.netapp.com/advisory/ntap-20171120-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"name": "1039852",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039852"
},
{
"name": "101917",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101917"
},
{
"name": "https://twitter.com/PTsecurity_UK/status/938447926128291842",
"refsource": "MISC",
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"name": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr",
"refsource": "CONFIRM",
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_17_73",
"refsource": "CONFIRM",
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"name": "https://www.asus.com/News/wzeltG5CjYaIwGJ0",
"refsource": "CONFIRM",
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:intel:manageability_engine_firmware:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:intel:manageability_engine_firmware:11.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:intel:manageability_engine_firmware:11.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:intel:manageability_engine_firmware:11.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:intel:manageability_engine_firmware:11.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:intel:manageability_engine_firmware:11.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@intel.com",
"ID": "CVE-2017-5705"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"name": "https://security.netapp.com/advisory/ntap-20171120-0001/",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"name": "1039852",
"refsource": "SECTRACK",
"tags": [
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1039852"
},
{
"name": "101917",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101917"
},
{
"name": "https://twitter.com/PTsecurity_UK/status/938447926128291842",
"refsource": "MISC",
"tags": [],
"url": "https://twitter.com/PTsecurity_UK/status/938447926128291842"
},
{
"name": "https://www.asus.com/News/wzeltG5CjYaIwGJ0",
"refsource": "CONFIRM",
"tags": [],
"url": "https://www.asus.com/News/wzeltG5CjYaIwGJ0"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_17_73",
"refsource": "CONFIRM",
"tags": [],
"url": "https://www.synology.com/support/security/Synology_SA_17_73"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf",
"refsource": "CONFIRM",
"tags": [],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2018-05-11T01:29Z",
"publishedDate": "2017-11-21T14:29Z"
}
}
}
var-201711-0644
Vulnerability from variot
Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code. Intel Manageability Engine The Intel Management Engine is Intel's thermal management driver for its desktop family of chipsets. Local attackers can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Intel Xeon Processor E3-1200 and others are CPUs (Central Processing Units) of Intel Corporation. The following products and versions are affected: Intel Manageability Engine Firmware Version 11.0, Version 11.5, Version 11.6, Version 11.7, Version 11.10, Version 11.20; 6th, 7th, and 8th Generation Intel Core Processor Family; Intel Xeon Processor E3-1200 v5 and v6 Product Family; Intel Xeon Processor Scalable Family; Intel Xeon Processor W Family; Intel Atom C3000 Processor Family; Apollo Lake Intel Atom Processor E3900 series; Apollo Lake Intel Pentium; Celeron N and J series Processors
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201711-0644",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "manageability engine",
"scope": "eq",
"trust": 3.3,
"vendor": "intel",
"version": "11.7"
},
{
"model": "manageability engine",
"scope": "eq",
"trust": 3.3,
"vendor": "intel",
"version": "11.6"
},
{
"model": "manageability engine",
"scope": "eq",
"trust": 3.3,
"vendor": "intel",
"version": "11.5"
},
{
"model": "manageability engine",
"scope": "eq",
"trust": 3.3,
"vendor": "intel",
"version": "11.20"
},
{
"model": "manageability engine",
"scope": "eq",
"trust": 3.3,
"vendor": "intel",
"version": "11.10"
},
{
"model": "manageability engine",
"scope": "eq",
"trust": 3.3,
"vendor": "intel",
"version": "11.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "manageability engine",
"version": "11.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "manageability engine",
"version": "11.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "manageability engine",
"version": "11.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "manageability engine",
"version": "11.7"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "manageability engine",
"version": "11.10"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "manageability engine",
"version": "11.20"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "BID",
"id": "101917"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
},
{
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:intel:manageability_engine_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mark Ermolov and Maxim Goryachy from Positive Technologies",
"sources": [
{
"db": "BID",
"id": "101917"
}
],
"trust": 0.3
},
"cve": "CVE-2017-5705",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2017-5705",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2017-37849",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "e2e09270-39ab-11e9-9930-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-113908",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2017-5705",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-5705",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-5705",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2017-37849",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201711-887",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-113908",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "VULHUB",
"id": "VHN-113908"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
},
{
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code. Intel Manageability Engine The Intel Management Engine is Intel\u0027s thermal management driver for its desktop family of chipsets. \nLocal attackers can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Intel Xeon Processor E3-1200 and others are CPUs (Central Processing Units) of Intel Corporation. The following products and versions are affected: Intel Manageability Engine Firmware Version 11.0, Version 11.5, Version 11.6, Version 11.7, Version 11.10, Version 11.20; 6th, 7th, and 8th Generation Intel Core Processor Family; Intel Xeon Processor E3-1200 v5 and v6 Product Family; Intel Xeon Processor Scalable Family; Intel Xeon Processor W Family; Intel Atom C3000 Processor Family; Apollo Lake Intel Atom Processor E3900 series; Apollo Lake Intel Pentium; Celeron N and J series Processors",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-5705"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "BID",
"id": "101917"
},
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-113908"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-5705",
"trust": 3.6
},
{
"db": "BID",
"id": "101917",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1039852",
"trust": 1.1
},
{
"db": "SIEMENS",
"id": "SSA-892715",
"trust": 1.1
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-37849",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-18-060-01",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E09270-39AB-11E9-9930-000C29342CB1",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-113908",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "VULHUB",
"id": "VHN-113908"
},
{
"db": "BID",
"id": "101917"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
},
{
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"id": "VAR-201711-0644",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "VULHUB",
"id": "VHN-113908"
}
],
"trust": 1.4769231
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
}
]
},
"last_update_date": "2024-11-23T21:53:37.899000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "INTEL-SA-00086",
"trust": 0.8,
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086\u0026languageid=en-fr"
},
{
"title": "NTAP-20171120-0001",
"trust": 0.8,
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"title": "Patch for Intel Manageability Engine Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/111461"
},
{
"title": "Multiple Intel product Manageability Engine Firmware Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76619"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-113908"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://security-center.intel.com/advisory.aspx?intelid=intel-sa-00086\u0026languageid=en-fr"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/101917"
},
{
"trust": 1.1,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
},
{
"trust": 1.1,
"url": "https://security.netapp.com/advisory/ntap-20171120-0001/"
},
{
"trust": 1.1,
"url": "https://www.asus.com/news/wzeltg5cjyaiwgj0"
},
{
"trust": 1.1,
"url": "https://www.synology.com/support/security/synology_sa_17_73"
},
{
"trust": 1.1,
"url": "https://twitter.com/ptsecurity_uk/status/938447926128291842"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1039852"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5705"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-060-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-5705"
},
{
"trust": 0.3,
"url": "http://www.intel.com/content/www/us/en/homepage.html"
},
{
"trust": 0.1,
"url": "https://security-center.intel.com/advisory.aspx?intelid=intel-sa-00086\u0026amp;languageid=en-fr"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "VULHUB",
"id": "VHN-113908"
},
{
"db": "BID",
"id": "101917"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
},
{
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"db": "VULHUB",
"id": "VHN-113908"
},
{
"db": "BID",
"id": "101917"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
},
{
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-12-22T00:00:00",
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"date": "2017-12-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"date": "2017-11-21T00:00:00",
"db": "VULHUB",
"id": "VHN-113908"
},
{
"date": "2017-11-20T00:00:00",
"db": "BID",
"id": "101917"
},
{
"date": "2017-12-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"date": "2017-11-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201711-887"
},
{
"date": "2017-11-21T14:29:00.290000",
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-12-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-37849"
},
{
"date": "2018-05-11T00:00:00",
"db": "VULHUB",
"id": "VHN-113908"
},
{
"date": "2017-12-19T22:37:00",
"db": "BID",
"id": "101917"
},
{
"date": "2019-07-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-010519"
},
{
"date": "2017-11-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201711-887"
},
{
"date": "2024-11-21T03:28:15.513000",
"db": "NVD",
"id": "CVE-2017-5705"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "101917"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Intel Manageability Engine Buffer Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37849"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "e2e09270-39ab-11e9-9930-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201711-887"
}
],
"trust": 0.8
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…