CVE-2017-11165 Information disclosure in n/a
Remote attackers can obtain sensitive credentials and configuration data by requesting a specific URI on dataTaker DT80 dEX devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-11165?
CVE-2017-11165 is a critical vulnerability in n/a, published on 12 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
Weakness: CWE-200
Which versions are affected by CVE-2017-11165?
It affects 1 product.
Products include Thermofisher Dt80 Dex Firmware.
How do I fix CVE-2017-11165?
No fix has been published for CVE-2017-11165 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-11165 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-11165 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Sources
Also known as GHSA-h4fr-cprr-q23r.