CVE-2017-5163

MEDIUM

Belden Hirschmann GECKO Lite <2.0.00 - Path Traversal

Title source: llm

Description

An issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. After an administrator downloads a configuration file, a copy of the configuration file, which includes hashes of user passwords, is saved to a location that is accessible without authentication by path traversal.

References (2)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/95815

[Patch, Third Party Advisory, US Government Resource] https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02

Scores

CVSS v3 5.9

EPSS 0.0138

EPSS Percentile 80.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-22

Status published

Affected Products (2)

belden_hirschmann/gecko_lite_managed_switch_firmware < 2.0.00

n/a/Belden Hirschmann GECKO 2.0.00 and prior < Belden Hirschmann GECKO 2.0.00 and prior

Timeline

Published Feb 13, 2017

Tracked Since Feb 18, 2026