Exemys Web Server Bypass Hole
Tuesday, November 17, 2015 @ 07:11 PM gHale
There is a login bypass in the Exemys Telemetry Web Server and the company has not produced a patch to mitigate this vulnerability, according to a report on ICS-CERT.
Exemys Telemetry Web Server suffers from the remotely exploitable vulnerability discovered by Independent researcher Maxim Rupp.
This vulnerability can allow access to the server without proper login credentials.
Exemys is an Argentina-based company that exports to the United States, Canada, Latin America, Asia, and Europe.
The affected product, Telemetry Web Server, is a web-based SCADA system. According to Exemys, Telemetry Web Servers see action across several sectors including critical manufacturing, energy, financial services, healthcare and public health, and information technology. Exemys estimates these products see use primarily in the United States, Latin America, Europe, and Asia.
The Exemys Telemetry Web Server allows the attacker to directly access the information by ignoring the location header.
CVE-2015-7910 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.6.
No known public exploits specifically target this vulnerability.
An attacker with a low skill would be able to exploit this vulnerability.
ICS-CERT recommends implementing a single point login that cannot end up bypassed.