CVE-2017-15567

The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://gist.github.com/shiham101/4c49ece8ecac7c3c02ecbc6942aeca80	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:idemia:mso_1300_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:idemia:mso_1300:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-10-23 08:29

Updated : 2024-05-17 01:15

NVD link : CVE-2017-15567

Mitre link : CVE-2017-15567

CVE.ORG link : CVE-2017-15567

JSON object : View

Products Affected

idemia

mso_1300
mso_1300_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-15567", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2017-10-23T08:29:00.680", "references": [{"url": "https://gist.github.com/shiham101/4c49ece8ecac7c3c02ecbc6942aeca80", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK"}, {"lang": "es", "value": "** EN DISPUTA ** El componente de importaci\u00f3n de certificados en los dispositivos IDEMIA (anteriormente Morpho) MorphoSmart 1300 Series (tambi\u00e9n conocidos como MSO 1300 Series) permite que los usuarios locales obtengan un shell de comandos y, en consecuencia, obtengan privilegios mediante vectores sin especificar. NOTA: el fabricante discute esto debido a que no hay ning\u00fan shell de comandos en el producto o en el SDK asociado."}], "lastModified": "2024-05-17T01:15:14.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:idemia:mso_1300_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CB16DC5-ECE7-4C54-ADE6-4009D92F01F2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:idemia:mso_1300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "43FA320A-CCD5-42B9-AE18-613953B089A3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}