CVE-2017-16786

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or (2) vectors involving curl support of the "file" schema in the firmware update functionality.

CVSS v3 6.5 MEDIUM
CVSS v2.0 6.8 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:C/I:N/A:N

Exploitability : 8.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/145388/Meinberg-LANTIME-Web-Configuration-Utility-6.16.008-Arbitrary-File-Read.html	Issue Tracking Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2017/Dec/50	Issue Tracking Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:meinbergglobal:lantime_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:meinbergglobal:lantime_m100:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m1000:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m200:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m300:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m3000:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m400:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m500:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m600:-:::::::*
	cpe:2.3:h:meinbergglobal:lantime_m900:-:::::::*

History

No history.

Information

Published : 2017-12-19 15:29

Updated : 2024-02-04 19:29

NVD link : CVE-2017-16786

Mitre link : CVE-2017-16786

CVE.ORG link : CVE-2017-16786

JSON object : View

Products Affected

meinbergglobal

lantime_m3000
lantime_m1000
lantime_firmware
lantime_m600
lantime_m500
lantime_m300
lantime_m900
lantime_m400
lantime_m200
lantime_m100

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2017-16786", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2017-12-19T15:29:00.353", "references": [{"url": "http://packetstormsecurity.com/files/145388/Meinberg-LANTIME-Web-Configuration-Utility-6.16.008-Arbitrary-File-Read.html", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2017/Dec/50", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or (2) vectors involving curl support of the \"file\" schema in the firmware update functionality."}, {"lang": "es", "value": "Web Configuration Utility en dispositivos Meinberg LANTIME con firmware en versiones anteriores a la 6.24.004 permite que usuarios autenticados remotos con ciertos privilegios lean archivos arbitrarios mediante (1) el par\u00e1metro ntpclientcounterlogfile en cgi-bin/mainv2 o (2) vectores relacionados con la compatibilidad curl del esquema \"file\" en la funcionalidad de actualizaci\u00f3n de firmware."}], "lastModified": "2018-01-08T15:33:52.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:meinbergglobal:lantime_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "988C7D38-899A-41F5-AD4D-C9682E52E94E", "versionEndIncluding": "6.24.003"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:meinbergglobal:lantime_m100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2541CE93-F4C4-453E-83AC-ED39D83571DF"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m1000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E35F4190-89B4-4F14-89C9-C7A4E61FB300"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A0C58392-64BE-4A64-9B43-F599D03CBD3E"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D5FCA50A-2C6A-41ED-8E9D-38BA52C8428B"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m3000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E589DF47-1C04-4111-9C2B-3B6F9396ED5A"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "51E5EFBE-3C3F-4386-A469-E190611A5A34"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "058F2582-3447-4B8B-8B50-44C1B971CE88"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "46F4C7AA-30BB-402B-A21C-6FEEC919853C"}, {"criteria": "cpe:2.3:h:meinbergglobal:lantime_m900:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "164CB3CF-F979-4591-8DF8-972123E216B0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}