Meteocontrol WEB'log Vulnerabilities (Update A)
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-4504US | high8.8 | — | ||
A Cross-Site Request Forgery issue was discovered in Meteocontrol WEB'log Basic 100 all versions, Light all versions, Pro all versions, and Pro Unlimited all versions. There is no… | ||||
| CVE-2016-2298US | critical9.8 | Exploit | ||
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors. | ||||
| CVE-2016-2297US | critical9.4 | — | ||
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an "access command shell-like feature." | ||||
| CVE-2016-2296US | critical9.4 | Exploit | ||
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive inform… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-16-133-01A JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-16-133-01A - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (16)
- MitigationWEB'log Basic 100
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Basic 100
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Basic 100
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Basic 100
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Light
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Light
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Light
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Light
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro Unlimited
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro Unlimited
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro Unlimited
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/. - MitigationWEB'log Pro Unlimited
Meteocontrol strongly recommends users install the WEB'log behind a firewall. It is not intended to be used with a direct connection to the Internet. Meteocontrol has produced a new version that fixes the vulnerabilities. It can be downloaded at: (http://us.meteocontrol.com/downloads/.)
http://us.meteocontrol.com/downloads/.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan