CVE-2017-17974
CriticalSummary
A vulnerability in BAS920 and ISC2000 devices allows remote attackers to obtain sensitive information through a specific request. Attackers can gain credential information for the Supervisor/Administrator account.
Risk Assessment
The risk to the organization involves the potential for unauthorized access to sensitive information, which could lead to serious security breaches.
Recommendation
It is recommended to update the device firmware to the latest version and implement additional security measures to restrict access to critical resources.
Original NVD description (English source)
BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/get_sid_js.aspx or isc/get_sid.aspx, as demonstrated by obtaining administrative access by subsequently using the credential information for the Supervisor/Administrator account.