CVE-2015-7921

{"id": "CVE-2015-7921", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2016-04-06T23:59:02.473", "references": [{"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-096-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials."}, {"lang": "es", "value": "El servidor FTP en Pro-face GP-Pro EX EX-ED en versiones anteriores a 4.05.000, PFXEXEDV en versiones anteriores a 4.05.000, PFXEXEDLS en versiones anteriores a 4.05.000 y PFXEXGRPLS en versiones anteriores a 4.05.000 tiene credenciales embebidas, lo que facilita a atacantes remotos eludir la autenticaci\u00f3n aprovechando el conocimiento de esas credenciales."}], "lastModified": "2022-01-31T19:43:33.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:proface_gp-pro_ex_ex-ed:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2514428-2463-432A-940A-5C46E56B1989", "versionEndIncluding": "4.0.4"}, {"criteria": "cpe:2.3:a:schneider-electric:proface_gp-pro_ex_pfxexedls:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5337F7BF-3352-456A-B11D-F481874B4CD0", "versionEndIncluding": "4.0.4"}, {"criteria": "cpe:2.3:a:schneider-electric:proface_gp-pro_ex_pfxexedv:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3FF0F1A-D633-40D7-8AE4-0F36419113FF", "versionEndIncluding": "4.0.4"}, {"criteria": "cpe:2.3:a:schneider-electric:proface_gp-pro_ex_pfxexgrpls:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EF38666-B916-410C-993C-5386186CCDCE", "versionEndIncluding": "4.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}