CVE-2016-9358

EUVD-2016-10168 · Published Jun 30, 2017

A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. The end user does not have the ability to change system passwords.

Technologies

Marel Sensorx13 Qc Flow LineMarel A520 Slave FirmwareMarel Sensorx23 Qc Slave FirmwareMarel A520 Master FirmwareMarel Ipm3 Dual Cam FirmwareMarel A571 FirmwareMarel Ipm3 Dual CamMarel Speed BatcherMarel T377Marel A371Marel V36B FirmwareMarel P520 FirmwareMarel A325 FirmwareMarel P520Marel P574Marel A325Marel T374 FirmwareMarel A520 MasterMarel A320 FirmwareMarel Speed Batcher FirmwareMarel Flowlineqc T376 FirmwareMarel Sensorx23 Qc MasterMarel V36Marel A542 FirmwareMarel A571Marel T374Marel V36BMarel A320Marel Check Bin GraderMarel V36C FirmwareMarel Sensorx23 Qc SlaveMarel Sensorx13 Qc Flow Line FirmwareMarel A530Marel V36 FirmwareMarel A542Marel A520 SlaveMarel Check Bin Grader FirmwareMarel T377 FirmwareMarel Sensorx23 Qc Master FirmwareMarel V36CMarel A371 FirmwareMarel A530 FirmwareMarel P574 FirmwareMarel Flowlineqc T376

Weaknesses

CWE-259CWE-798

CVSS scores

v3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
v2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Privilege Escalation Stealth Credential Access

T1190Exploit Public-Facing Application T1078.001Default Accounts T1552.001Credentials In Files

References

Potentially impacted assets

See if this affects your attack surface