Multiple Siemens OZW672 and OZW772 Multiple Authentication Bypass Vulnerabilities

Bugtraq ID:	99473
Class:	Design Error
CVE:	CVE-2017-6872 CVE-2017-6873
Remote:	Yes
Local:	No
Published:	Jul 06 2017 12:00AM
Updated:	Jul 06 2017 12:00AM
Credit:	Stefan Viehböck from SEC Consult.
Vulnerable:	Siemens OZW772 0 Siemens OZW672 0
Not Vulnerable:

Multiple Siemens OZW672 and OZW772 Multiple Authentication Bypass Vulnerabilities

Multiple Siemens OZW672 and OZW772 are prone to multiple authentication-bypass vulnerabilities.

An attacker can exploit these issues to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks.

Multiple Siemens OZW672 and OZW772 Multiple Authentication Bypass Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Siemens OZW672 and OZW772 Multiple Authentication Bypass Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Siemens OZW672 and OZW772 Multiple Authentication Bypass Vulnerabilities

References:

• Siemens Homepage (Siemens)
  
• ICSA-17-187-01:Siemens OZW672 and OZW772 (CERT)
  
• SSA-563539: Vulnerabilities in OZW672 and OZW772 (Siemens)