CVE-2017-14003

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has been identified, which, if exploited, would allow an attacker with the same IP address to bypass authentication by accessing a specific uniform resource locator.

Score

CVSS 3.0 9.8 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2017-10-11

Last modified

2024-08-05

Weaknesses

CWE-287, CWE-290

Affected products

• Ether-serial Link Firmware (Lavalink)

References

• http://www.securityfocus.com/bid/101226
• https://ics-cert.us-cert.gov/advisories/ICSA-17-283-01