{
  "id": "CVE-2017-14728",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2019-06-03T19:29:00.220",
  "lastModified": "2019-06-04T19:46:09.940",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una omisi\u00f3n de autenticaci\u00f3n en un \u00e1rea desconocida del c\u00f3digo fuente de SiteOmat. Todas las versiones de SiteOmat BOS se ven afectadas, antes de enviar este exploit. Adem\u00e1s, SiteOmat no obliga a los administradores a cambiar las contrase\u00f1as, dejando la autenticaci\u00f3n remota de SSH y HTTP abierta al p\u00fablico."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:orpak:siteomat:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "6.4.414.084",
              "matchCriteriaId": "FF41A56A-914A-4D8D-A310-AED1BC1CE9BA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.orpak.com/allproducts/siteomat-station-controller-sw/",
      "source": "cve@mitre.org",
      "tags": [
        "Product",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/108167",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01",
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource",
        "Third Party Advisory"
      ]
    }
  ]
}