VDE-2017-002

Vulnerability from csaf_phoenixcontactgmbhcokg - Published: 2017-09-07 07:00 - Updated: 2025-05-22 13:03
Summary
PHOENIX CONTACT: mGuard device manager (mdm) multiple vulnerabilities in Java SE
Notes
Summary: Multiple security issues and vulnerabilities in Oracle Java SE possibly affecting mGuard device manager (mdm / FL MGUARD DM) 1.8.0 and older.
Impact: Please see the various CVE entries for details.
Remediation: PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer. PHOENIX CONTACT that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10102

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.

9 (Critical)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10116

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

8.3 (High)
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10078

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

8.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10115

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10118

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10176

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10198

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

6.8 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10135

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10053

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
CVE-2017-10108

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
0 (None)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N
CWE-284 - Improper Access Control
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section 'Software' on the Downloads tab. For more information please refer to the document 'How to upgrade mGuard device manager' downloaded with the installer.
Vendor Fix PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.
References
Acknowledgments
CERT@VDE certvde.com
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple security issues and vulnerabilities in Oracle Java SE possibly affecting mGuard device manager (mdm / FL MGUARD DM) 1.8.0 and older.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Please see the various CVE entries for details.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. PHOENIX CONTACT that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@phoenixcontact.com",
      "name": "Phoenix Contact GmbH \u0026 Co. KG",
      "namespace": "https://phoenixcontact.com/psirt"
    },
    "references": [
      {
        "category": "external",
        "summary": "Phoenix Contact PSIRT",
        "url": "https://www.phoenixcontact.com/de-de/service-und-support/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Phoenix Contact",
        "url": "https://certvde.com/en/advisories/vendor/phoenixcontact/"
      },
      {
        "category": "self",
        "summary": "VDE-2017-002: PHOENIX CONTACT: mGuard device manager (mdm) multiple vulnerabilities in Java SE - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2017-002/"
      },
      {
        "category": "self",
        "summary": "VDE-2017-002: PHOENIX CONTACT: mGuard device manager (mdm) multiple vulnerabilities in Java SE - CSAF",
        "url": "https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2017/vde-2017-002.json"
      }
    ],
    "title": "PHOENIX CONTACT: mGuard device manager (mdm) multiple vulnerabilities in Java SE",
    "tracking": {
      "aliases": [
        "VDE-2017-002"
      ],
      "current_release_date": "2025-05-22T13:03:10.000Z",
      "generator": {
        "date": "2024-11-14T10:49:21.384Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.13"
        }
      },
      "id": "VDE-2017-002",
      "initial_release_date": "2017-09-07T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2017-09-07T07:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2024-11-06T11:27:01.000Z",
          "number": "2",
          "summary": "Fix: correct certvde domain, added self-reference"
        },
        {
          "date": "2024-11-14T11:00:00.000Z",
          "number": "3",
          "summary": "fixed product tree"
        },
        {
          "date": "2025-05-22T13:03:10.000Z",
          "number": "4",
          "summary": "Fix: version space, removed ia, quotation mark"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Windows",
                "product": {
                  "name": "Microsoft Windows",
                  "product_id": "CSAFPID-9002"
                }
              }
            ],
            "category": "product_family",
            "name": "OS"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.8.0",
                    "product": {
                      "name": "Phoenix Contact Software FL MGUARD DM \u003c=1.8.0",
                      "product_id": "CSAFPID-5101"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.8.0.1",
                    "product": {
                      "name": "Phoenix Contact Software FL MGUARD DM 1.8.0.1",
                      "product_id": "CSAFPID-5201"
                    }
                  }
                ],
                "category": "product_name",
                "name": "FL MGUARD DM"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Phoenix Contact"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Linux",
                "product": {
                  "name": "Linux",
                  "product_id": "CSAFPID-9001"
                }
              }
            ],
            "category": "product_family",
            "name": "OS"
          }
        ],
        "category": "vendor",
        "name": "Linux"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ],
        "summary": "Affected Products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "summary": "Fixed Products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Phoenix Contact FL MGUARD DM \u003c=1.8.0 installed on Linux",
          "product_id": "CSAFPID-3101"
        },
        "product_reference": "CSAFPID-5101",
        "relates_to_product_reference": "CSAFPID-9001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Phoenix Contact FL MGUARD DM \u003c=1.8.0 installed on Microsoft Windows",
          "product_id": "CSAFPID-3102"
        },
        "product_reference": "CSAFPID-5101",
        "relates_to_product_reference": "CSAFPID-9002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Phoenix Contact FL MGUARD DM 1.8.0.1 installed on Linux",
          "product_id": "CSAFPID-3201"
        },
        "product_reference": "CSAFPID-5201",
        "relates_to_product_reference": "CSAFPID-9001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Phoenix Contact FL MGUARD DM 1.8.0.1 installed on Microsoft Windows",
          "product_id": "CSAFPID-3202"
        },
        "product_reference": "CSAFPID-5201",
        "relates_to_product_reference": "CSAFPID-9002"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-10102",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 9,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10102"
    },
    {
      "cve": "CVE-2017-10116",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.3,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 8.3,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10116"
    },
    {
      "cve": "CVE-2017-10078",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10078"
    },
    {
      "cve": "CVE-2017-10115",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10115"
    },
    {
      "cve": "CVE-2017-10118",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10118"
    },
    {
      "cve": "CVE-2017-10176",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10176"
    },
    {
      "cve": "CVE-2017-10198",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.8,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 6.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10198"
    },
    {
      "cve": "CVE-2017-10135",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 5.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10135"
    },
    {
      "cve": "CVE-2017-10053",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10053"
    },
    {
      "cve": "CVE-2017-10108",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-3201",
          "CSAFPID-3202"
        ],
        "known_affected": [
          "CSAFPID-3101",
          "CSAFPID-3102"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Windows should update to at least version 1.8.0.1. The update can be performed by simply executing the installer for version 1.8.0.1 on a Windows system where the product is installed in version 1.8.0. The installer is available for download on the product page external link, in section \u0027Software\u0027 on the Downloads tab. For more information please refer to the document \u0027How to upgrade mGuard device manager\u0027 downloaded with the installer. ",
          "product_ids": [
            "CSAFPID-3102"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PHOENIX CONTACT recommends that all users of the affected product on Linux should update Java to the latest version. When using the packet source delivered by PHOENIX CONTACT on Ubuntu, this is simply done by using the software updater of the operating system.",
          "product_ids": [
            "CSAFPID-3101"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 5.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3101",
            "CSAFPID-3102"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0,
            "environmentalSeverity": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 0,
            "temporalSeverity": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-3201",
            "CSAFPID-3202"
          ]
        }
      ],
      "title": "CVE-2017-10108"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.