CVE-2016-2275: Critical severity advantech vesp211-eu firmware vulnerability

Published Feb 21, 2016

Updated

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code.

Affected Software

5 affected components

Advantech VESP211-EU

Advantech Vesp211-eu Firmware=1.7.2

Advantech VESP211-232

Advantech Vesp211-232 Firmware=1.5.1

Advantech Vesp211-232 Firmware=1.7.2

Event History

Feb 21, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2275?

CVE-2016-2275 has a medium severity rating because it allows remote administrative actions due to insufficient access control.

How do I fix CVE-2016-2275?

To fix CVE-2016-2275, users should upgrade the firmware of their Advantech/B+B SmartWorx devices to the latest version that addresses this vulnerability.

What devices are affected by CVE-2016-2275?

CVE-2016-2275 affects Advantech VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware versions 1.5.1 and 1.7.2.

What actions can attackers perform through CVE-2016-2275?

Attackers can perform unauthorized administrative actions by exploiting the lack of proper access control in the web interface.

Is CVE-2016-2275 a client-side vulnerability?

Yes, CVE-2016-2275 is considered a client-side vulnerability as it relies on the client to implement access control.