VulnerabilityModified
CVE-2015-3972
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access via a brute-force attack.
HIGH 10.0EPSS 2.86%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access via a brute-force attack.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 2.86% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-254
- Affected
- janitza/umg 508 · janitza/umg 509 · janitza/umg 511 · janitza/umg 604 · janitza/umg 605
- Source
- ics-cert@hq.dhs.gov
References
- https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03Patch, Third Party Advisory, US Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03Patch, Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.