Mettler Toledo IND780 Weighing Terminal Remote Unauthenticated Directory Traversal (CVE-2021-40661)

high Tenable OT Security Plugin ID 502352

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10'). It was possible to traverse the folders of the affected host by providing a traversal path to the 'webpage' parameter in AutoCE.ini This could allow a remote unauthenticated adversary to access additional files on the affected system. This could also allow the adversary to perform further enumeration against the affected host to identify the versions of the systems in use, in order to launch further attacks in future.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: High

ID: 502352

Version: 1.2

Type: remote

Family: Tenable.ot

Published: 8/7/2024

Updated: 8/8/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2021-40661

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:mt:ind780_firmware:8.0.07, cpe:/o:mt:ind780_firmware:7.2.10

Required KB Items: Tenable.ot/MettlerToledo

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/31/2022

Vulnerability Publication Date: 10/31/2022

Reference Information

CVE: CVE-2021-40661

CWE: 22

Detections

Analytics