Weak Password Security in Advantech SUISAccess Server
CVE-2016-9353

7.8HIGH

Key Information:

Vendor
Advantech
Status
Advantech Susiaccess Server 3.0 And Prior
Vendor
CVE Published:
13 February 2017

Summary

A vulnerability identified in the Advantech SUISAccess Server allows for the exposure of admin passwords. The server stores these passwords in an encrypted form using a static key that is hard-coded within the application. This flaw enables potential attackers to reverse-engineer the password, thus gaining unauthorized access to administrative functions. Organizations using affected versions of the software should prioritize reviewing security practices and consider implementing updated versions to mitigate risks.

Affected Version(s)

Advantech SUSIAccess Server 3.0 and prior Advantech SUSIAccess Server 3.0 and prior

References

https://ics-cert.us-cert.gov/advisories/ICSA-16-336-04
x_refsource_MISC
http://www.securityfocus.com/bid/94631
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.