CVE-2017-9644
published 2017-08-25CVE-2017-9644: An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL…
PriorityP339high7CVSS 3.0
AVLACHPRLUINSUCHIHAH
EXPLOIT
EPSS
1.41%
69.3th percentile
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An unquoted search path vulnerability may allow a non-privileged local attacker to change files in the installation directory and execute arbitrary code with elevated privileges.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| automatedlogic | i-vu | <= 5.2 | — |
| automatedlogic | i-vu | <= 5.5 | — |
| automatedlogic | i-vu | <= 6.0 | — |
| automatedlogic | i-vu | <= 6.5 | — |
| automatedlogic | sitescan_web | <= 5.2 | — |
| automatedlogic | sitescan_web | <= 5.5 | — |
| automatedlogic | sitescan_web | <= 6.1 | — |
| automatedlogic | sitescan_web | <= 6.5 | — |
| carrier | automatedlogic_webctrl | <= 5.2 | — |
| carrier | automatedlogic_webctrl | <= 5.5 | — |
| carrier | automatedlogic_webctrl | <= 6.0 | — |
| carrier | automatedlogic_webctrl | <= 6.1 | — |
| carrier | automatedlogic_webctrl | <= 6.5 | — |
CVSS provenance
nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c6hg-x56f-2f88: An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6
ghsa_unreviewed·2022-05-13
CVE-2017-9644 [HIGH] CWE-428 GHSA-c6hg-x56f-2f88: An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An unquoted search path vulnerability may allow a non-privileged local attacker to change files in the installation directory and execute arbitrary code with elevated privileges.
CISA ICS
Automated Logic Corporation WebCTRL, i-VU, SiteScan
cisa_ics·2017-08-22
Automated Logic Corporation WebCTRL, i-VU, SiteScan
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Automated Logic Corporation WebCTRL, i-VU, SiteScan
Last RevisedAugust 22, 2017
Alert CodeICSA-17-234-01
## CVSS v3 8.3
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: Automated Logic Corporation (ALC)
Equipment: WebCTRL, i-VU, SiteScan
Vulnerabilities: Unquoted Search Path or Element; Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); Unrestricted Upload of File with Dangerous Type
## AFFECTED PRODUCTS
The following versions of WebCTRL, i-Vu, SiteScan Web, building automation platforms, are affected:
- ALC WebCTRL, i-Vu, Si
No detection rules found.
No writeups or analysis indexed.
2017-08-25
Published