CVE-2021-3252

KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html	Exploit Technical Description Third Party Advisory
https://twitter.com/Kevin2600/status/1351189347501023238	Third Party Advisory
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:kaco-newenergy:xp100u_firmware:xp-java_2.0:*:*:*:*:*:*:*

cpe:2.3:h:kaco-newenergy:xp100u:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-02-23 15:15

Updated : 2024-02-04 21:23

NVD link : CVE-2021-3252

Mitre link : CVE-2021-3252

CVE.ORG link : CVE-2021-3252

JSON object : View

Products Affected

kaco-newenergy

xp100u_firmware
xp100u

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2021-3252", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-02-23T15:15:15.967", "references": [{"url": "https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://twitter.com/Kevin2600/status/1351189347501023238", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability."}, {"lang": "es", "value": "KACO New Energy XP100U versiones hasta XP-JAVA 2.0, est\u00e1 afectado por un control de acceso incorrecto. Unas credenciales siempre ser\u00e1n devueltas en texto plano desde el servidor local durante el proceso de autenticaci\u00f3n de KACO XP100U, independientemente de las contrase\u00f1as que hayan sido proporcionadas, lo que conlleva a una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n"}], "lastModified": "2021-02-27T03:24:09.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:kaco-newenergy:xp100u_firmware:xp-java_2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7433757-F3B9-491B-8543-73D5D25F3FE8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:kaco-newenergy:xp100u:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4319EC8B-12C1-418E-B20C-9FA05648A0A6"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}