Unscored severity · published Oct 28, 2015
CVE-2015-3973
Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine a PIN value via unspecified…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine a PIN value via unspecified computations on session-token values.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
U5
Umg 508 · Janitza
All versions, or not specified · source: NVD
U5
Umg 509 · Janitza
All versions, or not specified · source: NVD
U5
Umg 511 · Janitza
All versions, or not specified · source: NVD
U6
Umg 604 · Janitza
All versions, or not specified · source: NVD
U6
Umg 605 · Janitza
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3973
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3973
Patch
https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03
More from Umg 508
–
CVE-2015-3972
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access…
–
CVE-2015-3971
The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute…
–
CVE-2015-3970
Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script…
–
CVE-2015-3969
Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235
–
CVE-2015-3968
The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to read or write to files via a session on…