CVE-2017-11165: Infoleak

Published Jul 12, 2017

Updated

dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.

Affected Software

4 affected components

dataTaker Dt80 Dex Firmware=1.50.012

dataTaker DT80 dEX

All of the following

Thermofisher Dt80 Dex Firmware=1.50.012

Thermofisher Dt80 Dex

Event History

Jul 12, 2017

CVE Published

via MITRE·12:00 PM

Data Sourced

via MITRE·12:00 PM

Description

Data Sourced

via NVD·12:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-11165?

CVE-2017-11165 has a moderate severity rating due to the risk of unauthorized access to sensitive configuration data.

How do I fix CVE-2017-11165?

To fix CVE-2017-11165, update the dataTaker DT80 dEX firmware to the latest version that mitigates this vulnerability.

What is the impact of CVE-2017-11165?

The impact of CVE-2017-11165 allows remote attackers to access sensitive credentials and configuration files, compromising system security.

Can CVE-2017-11165 be exploited remotely?

Yes, CVE-2017-11165 can be exploited remotely through a direct URL request to obtain sensitive information.

What version of dataTaker DT80 dEX is affected by CVE-2017-11165?

The version affected by CVE-2017-11165 is dataTaker DT80 dEX firmware version 1.50.012.