NVD

Id
27371  
Name
CVE-2015-6456  
Description
GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password.  
Reject
 
CVSS Version
2  
CVSS Score
9  
Severity
High  
CVSS Base Score
9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2015-09-18  
Modified Date
2015-09-23  
Seq
2015-6456  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
143964 27371 CVE-2015-6456 http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9  View
143965 27371 CVE-2015-6456 http://zerodayinitiative.com/advisories/ZDI-15-440/  View
143966 27371 CVE-2015-6456 https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9604 JVNDB-2015-004924 GE Digital Energy MDS PulseNET および MDS PulseNET Enterprise における管理アクセス権を取得される脆弱性 GE Digital Energy MDS PulseNET および MDS PulseNET Enterprise は、サポートアカウントに対してハードコードされた認証情報を持つため、管理アクセス権を取得され、その結果、任意のコードを実行される脆弱性が存在します。 CVE-2015-6456 83681 CVE-2015-6456 27371 9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004924.html 2015-09-15 2015-09-29 View