CVE-2017-6873 Security feature bypass in OZW672, OZW772
Attackers can read and modify TLS session data via MITM attacks on the integrated web server due to missing authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6873?
CVE-2017-6873 is a high-severity vulnerability in OZW672, OZW772, published on 8 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack on the integrated web server on port 443/tcp.
Weakness: CWE-306
Which versions are affected by CVE-2017-6873?
It affects 2 products.
Products include Siemens Ozw672 Firmware, Siemens Ozw772 Firmware.
How do I fix CVE-2017-6873?
No fix has been published for CVE-2017-6873 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-6873 being exploited?
There is no known exploitation of CVE-2017-6873 in the wild and no public exploit code.
Other vulnerabilities in OZW672, OZW772
Sources
Also known as GHSA-c29x-q9mw-w4j4.