CVE-2017-9664 Path traversal in ABB SREA-01 and SREA-50
Attackers can access internal files and execute commands on ABB SREA devices via path traversal, leading to credential theft and system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9664?
CVE-2017-9664 is a critical path traversal vulnerability in ICS-CERT ABB SREA-01 and SREA-50, published on 24 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which refers to files using ../../ relative paths. Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization.
Which versions are affected by CVE-2017-9664?
It affects 2 products.
Products include Abb Srea-01 Firmware, Abb Srea-50 Firmware.
How do I fix CVE-2017-9664?
No fix has been published for CVE-2017-9664 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-9664 being exploited?
There is no known exploitation of CVE-2017-9664 in the wild and no public exploit code.
Sources
Also known as GHSA-5jjf-r4x7-8q23.