CVE-2017-9650
published 2017-08-25CVE-2017-9650: An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC…
PriorityP351high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
2.37%
81.7th percentile
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| automatedlogic | i-vu | <= 5.2 | — |
| automatedlogic | i-vu | <= 5.5 | — |
| automatedlogic | i-vu | <= 6.0 | — |
| automatedlogic | i-vu | <= 6.5 | — |
| automatedlogic | sitescan_web | <= 5.2 | — |
| automatedlogic | sitescan_web | <= 5.5 | — |
| automatedlogic | sitescan_web | <= 6.1 | — |
| automatedlogic | sitescan_web | <= 6.5 | — |
| carrier | automatedlogic_webctrl | <= 5.2 | — |
| carrier | automatedlogic_webctrl | <= 5.5 | — |
| carrier | automatedlogic_webctrl | <= 6.0 | — |
| carrier | automatedlogic_webctrl | <= 6.1 | — |
| carrier | automatedlogic_webctrl | <= 6.5 | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pxc9-7g5q-6fjm: An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6
ghsa_unreviewed·2022-05-13
CVE-2017-9650 [HIGH] CWE-434 GHSA-pxc9-7g5q-6fjm: An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code.
CISA ICS
Automated Logic Corporation WebCTRL, i-VU, SiteScan
cisa_ics·2017-08-22
Automated Logic Corporation WebCTRL, i-VU, SiteScan
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Automated Logic Corporation WebCTRL, i-VU, SiteScan
Last RevisedAugust 22, 2017
Alert CodeICSA-17-234-01
## CVSS v3 8.3
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: Automated Logic Corporation (ALC)
Equipment: WebCTRL, i-VU, SiteScan
Vulnerabilities: Unquoted Search Path or Element; Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); Unrestricted Upload of File with Dangerous Type
## AFFECTED PRODUCTS
The following versions of WebCTRL, i-Vu, SiteScan Web, building automation platforms, are affected:
- ALC WebCTRL, i-Vu, Si
No detection rules found.
No writeups or analysis indexed.
2017-08-25
Published