Medium severity · published Aug 25, 2017
CVE-2017-9640
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu…
6.3
CVSS
8.5%
EPSS
No
On KEV
Description
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to overwrite files that are used to execute code. This vulnerability does not affect version 6.5 of the software.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Automatedlogic Webctrl · Carrier
through 5.2; through 5.5; through 6.0; through 6.1 · source: NVD
IV
I-vu · Automatedlogic
through 5.2; through 5.5; through 6.0 · source: NVD
SW
Sitescan Web · Automatedlogic
through 5.2; through 5.5; through 6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9640
Third Party Advisory
http://www.securityfocus.com/bid/100452
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-17-234-01
Third Party Advisory
https://www.exploit-db.com/exploits/42543/
More from I-vu
7.8
CVE-2017-9650
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan…
7.3
CVE-2016-5795
An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and…
7.0
CVE-2017-9644
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and…