CVE-2017-13081
lowPriorität · verfolgen · 22OT-Risiko · erhöhtEPSS 0.020 · 80. PerzentilDEEURUUSEPSS · bewertet 2026-10-26
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenpepperl_fuchs_psirt
### Android **Affected Products:** Tab-Ex 01, Ex-Handy 09, Ex-Handy 209, Smart-Ex 01, Smart-Ex 201 Pepperl+Fuchs has released firmware updates for the following products: | Product | Date | Update Source | |---------------|-----------------------|----------------| | Smart-Ex 01 | Available since 09/2018 | FOTA-Update | | Smart-Ex 201 | Available since 10/2018 | FOTA-Update | --- ### Windows **Affected Products:** Pad-Ex 01, i.roc Ci70-Ex, CK70A-ATEX, CK71A-ATEX, CN70A-ATEX, CN70E-ATEX For *ecom instruments* devices running Windows, we recommend to apply the security update provided by Microsoft. If you are using **WPA-TKIP** in your WLAN, you should switch to **AES-CCMP** immediately. > **Note:** > This advisory will be updated as further details and/or software updates become available.
- Behobenendress_hauser_psirt
For Field Xpert handheld devices (SFX350/SFX370) running Windows Mobile, Endress+Hauser recommends to apply the security updates provided by Microsoft. Intermec/Honeywell as producer of the basis of the handheld provide the following security patch for the Windows Mobile operating system: SR18012500_802T_Cx70_WM65_ALL.CAB To obtain this patch, please contact your local Endress+Hauser representative. If you are using WPA-TKIP in your WLAN, you should switch to AES-CCMP immediately. For Field Xpert tablet PC for device configuration (SMT70) running Windows 10 Pro 1703 64 EN, Endress+Hauser strongly recommends updating to the newest available Windows version. As a general security measure Endress+Hauser strongly recommends to protect network access to the WIFI network with appropriate mechanisms. It is advised to configure the environment in order to run the devices in a protected IT environment. Note: This advisory will be updated as further details and/or software updates become available.
- MitigationRUGGEDCOM RS9xxWcisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationRUGGEDCOM RX1400 with WLAN interfacecisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSCALANCE W-700 (IEEE 802.11a/b/g)cisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSCALANCE W-700 (IEEE 802.11n)cisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSCALANCE W1750Dcisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSCALANCE WLC711cisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSCALANCE WLC712cisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSIMATIC ET200 PRO IM154-6 PN IWLANcisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSIMATIC IWLAN-PB/LINKcisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSIMATIC Mobile Panel 277(F) IWLANcisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSIMATIC RF350Mcisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSIMATIC RF650Mcisa_csaf_ot
Contact the RUGGEDCOM support team at:
- MitigationSINAMICS v20 Smart Access Modulecisa_csaf_ot
Contact the RUGGEDCOM support team at:
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.9–7.9
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (272)
Betroffene Produkte und Versionsbereiche.
- Cisco AP541N Wireless Access Pointalle Versionencert_bundDEcpe:/h:cisco:ap541n_wireless_access_point:-
- Cisco ASA (Adaptive Security Appliance)alle Versionencert_bundDEcpe:/a:cisco:adaptive_security_appliance_device_manager:-
- Cisco AnyConnect Secure Mobility Solutionalle Versionencert_bundDEcpe:/a:cisco:anyconnect_secure_mobility_client:-
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- VDE-2017-005Pepperl+Fuchs / ecom instruments: WLAN enabled products utilizing WPA2 encryption2017-12-11csaf · pepperl_fuchs_psirtDE
Multiple security issues and vulnerabilities within the WPA2 standard have been identified and publicized by Mr. Mathy Vanhoef of KU Leuven. These vulnerabilities may allow the reinstallation of a pairwise transient key, a group key, or an integrity key on either a wireless client or a wireless access point (AP). In consequence, an attacker could establish a man-in-the-middle position between AP and client facilitating packet decryption and injection. ecom instruments is a subsidiary company of PEPPERL+FUCHS.
- VDE-2019-005Endress+Hauser: WIFI enabled products utilising WPA22019-03-19csaf · endress_hauser_psirtDE
Multiple security issues and vulnerabilities within the WPA2 standard have been identified and publicized by Mr. Mathy Vanhoef of KU Leuven. These vulnerabilities may allow the reinstallation of a pairwise transient key, a group key, or an integrity key on either a wireless client or a wireless access point (AP). In consequence, an attacker could establish a man-in-the-middle position between AP and client facilitating packet decryption and injection. The Field Xpert SFX370 and SFX350 handhelds are manufactured by Pepperl+Fuchs/ecom instruments for Endress+Hauser. The Advisory for Pepperl+Fuchs/ecom instruments can be found here: VDE-2017-005
- WID-SEC-W-2025-0369IEEE WPA2: Mehrere SchwachstellenDeutsch2017-10-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IEEE WPA2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- ICSA-17-318-01ICSA-17-318-01_Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update F)2017-11-14icsa · cisa_csaf_otUS
Mathy Vanhoef, of the Katholieke Universiteit Leuven in Belgium, discovered these vulnerabilities.
auch bekannt als (9)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (81)
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.htmlcnnvd
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtcnnvd
- http://www.kb.cert.org/vuls/id/228519cnnvd
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlcnnvd
- http://www.securityfocus.com/bid/101274cnnvd
- http://www.securitytracker.com/id/1039573cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan