CVE-2017-9630 Auth bypass in PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch
Attackers can bypass authentication on PDQ Manufacturing car wash equipment web servers due to improper verification of credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9630?
CVE-2017-9630 is a critical authentication bypass vulnerability in PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch, published on 7 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The web server does not properly verify that provided authentication information is correct.
Weakness: CWE-287
Which versions are affected by CVE-2017-9630?
It affects 11 products.
Products include Pdqinc Laserjet Firmware, Pdqinc Laserwash 360 Firmware, Pdqinc Laserwash 360 Plus Firmware, Pdqinc Laserwash Autoxpress Firmware, Pdqinc Laserwash Autoxpress Plus Firmware, Pdqinc Laserwash G5 Firmware and 5 more.
How do I fix CVE-2017-9630?
No fix has been published for CVE-2017-9630 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-9630 being exploited?
There is no known exploitation of CVE-2017-9630 in the wild and no public exploit code.
Other vulnerabilities in PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch
Sources
Also known as GHSA-8fc6-p36r-87mm.