icsa-17-138-01
Vulnerability from csaf_cisa
Published
2017-05-18 00:00
Modified
2017-05-18 00:00
Summary
ICSA-17-138-01_Miele Professional PG 85 Series
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
Jens Regel of Schneider & Wulf publicly disclosed this vulnerability without ICS-CERT coordination.
{
"document": {
"acknowledgments": [
{
"names": [
"Jens Regel"
],
"organization": "Schneider \u0026 Wulf",
"summary": "disclosing this vulnerability without ICS-CERT coordination"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "summary",
"text": "Jens Regel of Schneider \u0026 Wulf publicly disclosed this vulnerability without ICS-CERT coordination.",
"title": "Summary"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "CISAservicedesk@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-17-138-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-138-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-17-138-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-138-01"
}
],
"title": "ICSA-17-138-01_Miele Professional PG 85 Series",
"tracking": {
"current_release_date": "2017-05-18T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA USCert CSAF Generator",
"version": "1"
}
},
"id": "ICSA-17-138-01",
"initial_release_date": "2017-05-18T00:00:00.000000Z",
"revision_history": [
{
"date": "2017-05-18T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-17-138-01 Miele Professional PG 85 Series"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "1.00 | 1.04",
"product": {
"name": "PG8535 version: 1.00 and 1.04",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "PG8535 version"
},
{
"branches": [
{
"category": "product_version",
"name": "2.02 | 2.51 2.52 | 2.54",
"product": {
"name": "PG8527 version: 2.02 2.51 2.52 and 2.54",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "PG8527 version"
},
{
"branches": [
{
"category": "product_version",
"name": "2.02 | 2.51 2.52 | 2.54",
"product": {
"name": "PG8528 version: 2.02 2.51 2.52 and 2.54",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "PG8528 version"
},
{
"branches": [
{
"category": "product_version",
"name": "1.10 | 1.14",
"product": {
"name": "PG8536 version: 1.10 and 1.14",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "PG8536 version"
}
],
"category": "vendor",
"name": "Miele Professional"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-7240",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The path traversal vulnerability has been identified, which may allow a remote attacker to access sensitive information by using special elements in the pathname to resolve to a location outside of a restricted directory.CVE-2017-7240 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Miele Professional issued patches for this vulnerability on May 4, 2017. Miele Professional is in the process of contacting all affected users via registered mail.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Users of affected machines can contact Miele Professional at 1-800-991-9380 to schedule service for a software update, which must be performed by a Miele Professional technician.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8527 version 2.02: Update to version 2.12",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8527 version 2.51: Update to version 2.61",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8527 version 2.52: Update to version 2.62",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8527 version 2.54: Update to version 2.64",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8528 version 2.02: Update to version 2.12",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8528 version 2.51: Update to version 2.61",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8528 version 2.52: Update to version 2.62",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8528 version 2.54: Update to version 2.64",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8535 version 1.00: Update to version 1.10",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional PG 85 series PG8535 version 1.04: Update to version 1.14",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "vendor_fix",
"details": "Miele Professional PG 85 series PG8536 version 1.10: Update to version 1.20",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "vendor_fix",
"details": "Miele Professional PG 85 series PG8536 version 1.14: Update to version 1.24",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Miele Professional issued a press release addressing this vulnerability on March 29, 2017, which can be found here:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.miele.de/en/m/miele-admits-communication-glitch-4072.htm"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "CVE-2017-7240"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.