Endress+Hauser: Multiple products affected by log4net vulnerability
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-5753US | medium5.6 | Exploit | ||
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Make sure that no unauthorized access to the production environment is possible. Avoid using the above listed software with Windows administrator privileges if other users with lower privileges have access to the same software installation.
- Fixed
Endress+Hauser has provided the following updates with remediation of the vulnerability: - FieldCare Version 2.16 - DeviceCare Version 1.07.05 - Field Xpert Version 1.05.05 - OPC UA Connectivity Server Version 1.3.7818 Further updates are currently not planned by Endress+Hauser.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan