Summary
Successful exploitation of these vulnerabilities could allow a remote attacker to retrieve credentials stored in clear text to bypass authentication, and see and access critical information.
Vulnerabilities 2
-
Unscored —
Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of …
-
Unscored —
Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log …
Revision history
-
#1
ICSA-18-305-03 Circontrol CirCarLife
References
-
ICS Advisory ICSA-18-305-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-305-03
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
-
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-18-305-03