CVE-2016-2298
published 2016-05-14CVE-2016-2298: Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors.
PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
24.10%
97.6th percentile
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors.
Detection & IOCsextracted from sources · hover to see the quote
- →The Metasploit auxiliary module for this CVE targets HTTP-accessible Meteocontrol WEBlog appliances to extract administrator credentials without authentication — monitor for scanner/exploit activity against WEBlog management portals. ↗
- →Sensitive information including administrator credentials is stored and transmitted in cleartext — inspect HTTP traffic to/from WEBlog devices for credential exposure. ↗
- →All application functionality and configuration pages, including admin-only pages, are accessible without any authentication — alert on unauthenticated HTTP requests to administrative configuration endpoints on WEBlog devices. ↗
- →A hidden command shell feature is accessible without authentication — monitor for unauthenticated HTTP requests to shell/command endpoints on WEBlog devices. ↗
- ·Affected versions are all releases prior to the May 2016 update across all WEBlog product lines (Basic 100, Light, Pro, Pro Unlimited). ↗
- ·No CSRF token is generated per page or per function, enabling cross-site request forgery attacks that can silently modify plant/device configuration. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Meteocontrol WEB'log Vulnerabilities (Update A)
cisa_ics·2016-05-12
Meteocontrol WEB'log Vulnerabilities (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Meteocontrol WEB'log Vulnerabilities (Update A)
Last RevisedAugust 23, 2018
Alert CodeICSA-16-133-01A
## OVERVIEW
This updated advisory is a follow-up to the original advisory titled ICSA-16-133-01 Meteocontrol WEB'log Vulnerabilities that was published May 12, 2016, on the NCCIC/ICS‑CERT web site.
Independent researcher Karn Ganeshen has identified one authentication and two information exposure vulnerabilities in Meteocontrol’s WEB’log application. Meteocontrol has produced a new version to mitigate these vulnerabilities.
These vulnerabilities could be exploited remotely.
#
GHSA
GHSA-2vgj-xcrr-vp37: Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vector
ghsa_unreviewed·2022-05-17
CVE-2016-2298 [CRITICAL] CWE-200 GHSA-2vgj-xcrr-vp37: Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vector
Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecified vectors.
No detection rules found.
No writeups or analysis indexed.
2016-05-14
Published