CVE-2017-20238: Hirschmann Industrial HiVision Improper Authorization Privilege Escalation
Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hirschmann Industrial HiVisionto a version that resolves this vulnerability.Fixed in 06.0.06 - Upgrade
Upgrade
Hirschmann Industrial HiVisionto a version that resolves this vulnerability.Fixed in 07.0.01
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20238?
CVE-2017-20238 has a medium severity rating due to its potential for privilege escalation.
How do I fix CVE-2017-20238?
To fix CVE-2017-20238, upgrade Hirschmann Industrial HiVision to versions 06.0.06 or 07.0.01 or later.
What products are affected by CVE-2017-20238?
CVE-2017-20238 affects Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01.
What type of vulnerability is CVE-2017-20238?
CVE-2017-20238 is an improper authorization vulnerability leading to privilege escalation.
Who is the vendor for CVE-2017-20238?
The vendor for CVE-2017-20238 is Hirschmann.