High ICSA-18-191-03 2 CVEs

Tridium Niagara

Published Jul 10, 2018 · Updated Aug 16, 2018 · Revision 2

Vendor: Tridium Product: Niagara 4 Framework Product: Niagara AX Framework

Summary

Successful exploitation of these vulnerabilities could allow an attacker to read, write, and delete sensitive files to gain administrator privileges on the Niagara system.

Vulnerabilities 2

Unscored —

CVE-2017-16744 Public exploit

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prio…

ICS-CERT Niagara AX Framework and Niagara 4 Framework

Aug 20, 2018
Unscored —

CVE-2017-16748

An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework…

ICS-CERT Niagara AX Framework and Niagara 4 Framework

Aug 20, 2018

Revision history

2018-08-16 #2
ICSA-18-191-03 Tridium Niagara (Update A)
2018-07-10 #1
ICSA-18-191-03P Tridium Niagara

References

ICS Advisory ICSA-18-191-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-191-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B