2 lines
3.5 KiB
JSON
2 lines
3.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:kaco-newenergy:xp100u_firmware:xp-java_2.0:*:*:*:*:*:*:*","matchCriteriaId":"E7433757-F3B9-491B-8543-73D5D25F3FE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:kaco-newenergy:xp100u:-:*:*:*:*:*:*:*","matchCriteriaId":"4319EC8B-12C1-418E-B20C-9FA05648A0A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability."},{"lang":"es","value":"KACO New Energy XP100U versiones hasta XP-JAVA 2.0, está afectado por un control de acceso incorrecto. Unas credenciales siempre serán devueltas en texto plano desde el servidor local durante el proceso de autenticación de KACO XP100U, independientemente de las contraseñas que hayan sido proporcionadas, lo que conlleva a una vulnerabilidad de divulgación de información"}],"id":"CVE-2021-3252","lastModified":"2026-06-17T04:04:51.427","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-02-23T15:15:15.967","references":[{"source":"cve@mitre.org","tags":["Exploit","Technical Description","Third Party Advisory"],"url":"https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://twitter.com/Kevin2600/status/1351189347501023238"},{"source":"cve@mitre.org","tags":["Third Party Advisory","US Government Resource"],"url":"https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description","Third Party Advisory"],"url":"https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://twitter.com/Kevin2600/status/1351189347501023238"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"url":"https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"nvd@nist.gov","type":"Primary"}]}
|