CVE-2016-9353 : An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system

An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use.

Published 2017-02-13 21:59:02

Updated 2017-02-17 14:56:52

Source ICS-CERT

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2016-9353

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-9353

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2016-9353

http://www.securityfocus.com/bid/94631

Advantech SUSIAccess Server CVE-2016-9353 Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-336-04

Advantech SUSIAccess Server Vulnerabilities | CISA
Mitigation;Third Party Advisory;US Government Resource

CVEs referencing this url

Products affected by CVE-2016-9353

Advantech » Susiaccess
Versions up to, including, (<=) 3.0
cpe:2.3:a:advantech:susiaccess:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2016-9353

Exploit prediction scoring system (EPSS) score for CVE-2016-9353

CVSS scores for CVE-2016-9353

CWE ids for CVE-2016-9353

References for CVE-2016-9353

Products affected by CVE-2016-9353