Path Traversal in Hanwha-Security Smart Security Manager
CVE-2017-5168
An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a malicious page, an attacker can gain access to arbitrary files on the server. Smart Security Manager Versions 1.4 and prior to 1.31 are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.036 (89.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.036 · newest: 0.036 · change: 0.000
Affected products
- Hanwha-Security Smart Security Manager
- Hanwha Techwin Smart Security Manager Versions 1.5 And Prior — versions Hanwha Techwin Smart Security Manager Versions 1.5 and prior
Weakness classification (CWE)
References
- www.securityfocus.com/bid/96147 (VDB Entry, Third Party Advisory, vdb-entry)
- ics-cert.us-cert.gov/advisories/ICSA-17-040-01 (US Government Resource, Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-5168?
- CVE-2017-5168 is a high-severity vulnerability in Hanwha-Security Smart Security Manager, classified under Path Traversal. CVSS score: 7.5/10. Published 2017-02-13.
- How severe is CVE-2017-5168?
- High severity. CVSS v3 base score is 7.5 out of 10.