CVE-2017-16748

An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system.

Score

CVSS 3.0 9.8 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2018-08-20

Last modified

2024-09-17

Weaknesses

CWE-287

Affected products

• Niagara Ax Framework And Niagara 4 Framework (Ics-cert)
• Niagara (Tridium)
• Niagara Ax Framework (Tridium)

References

• http://www.securityfocus.com/bid/105101
• https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03
• https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01