CVE-2017-16748 An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, gran...
CriticalCVSS 9.8
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Tridium niagara | <= 4.4 | No fix listed |
| Tridium niagara ax framework | <= 3.8 | No fix listed |
| ICS-CERT Niagara AX Framework and Niagara 4 Framework | = Niagara AX Framework Versions 3.8 and prior and Niagara 4 Framework Versions 4.4 and prior | No fix listed |
References
- 105101 third-party-advisory vdb-entry
- ics-cert.us-cert.gov third-party-advisory us-government-resource vdb-entry
- ics-cert.us-cert.gov