CVE-2017-20237: Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution
Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hirschmann Industrial HiVisionto a version that resolves this vulnerability.Fixed in 06.0.07 - Upgrade
Upgrade
Hirschmann Industrial HiVisionto a version that resolves this vulnerability.Fixed in 07.0.03
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20237?
CVE-2017-20237 is categorized as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2017-20237?
The mitigation for CVE-2017-20237 is to upgrade Hirschmann Industrial HiVision to version 06.0.07 or 07.0.03 or later.
What types of attacks are possible with CVE-2017-20237?
CVE-2017-20237 allows unauthenticated remote attackers to execute arbitrary commands on the affected system.
Which versions of Hirschmann Industrial HiVision are affected by CVE-2017-20237?
CVE-2017-20237 affects Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03.
Is authentication required to exploit CVE-2017-20237?
No, CVE-2017-20237 does not require authentication, making it easier for attackers to exploit.