Search
Find a vulnerability
Search criteria
4 vulnerabilities found for lvis-3me by loytec
VAR-201710-0791
Vulnerability from variot - Updated: 2025-04-20 23:22A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: : 1. A directory-traversal vulnerability 2. An insufficient-entropy vulnerability 3. An information-disclosure vulnerability An attacker may leverage these issues to execute script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, execute arbitrary code within the context of the affected system or use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany. The vulnerability stems from the fact that the program does not fully authenticate Web requests
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0791",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lvis-3me",
"scope": "lte",
"trust": 1.0,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "lt",
"trust": 0.8,
"vendor": "loytec",
"version": "6.2.0"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.6,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.3,
"vendor": "loytec",
"version": "0"
},
{
"model": "lvis-3me",
"scope": "ne",
"trust": 0.3,
"vendor": "loytec",
"version": "6.2"
}
],
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
},
{
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:loytec:lvis-3me_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Davy Douhine of RandoriSec",
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
}
],
"trust": 0.9
},
"cve": "CVE-2017-13994",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2017-13994",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-104672",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2017-13994",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-13994",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-13994",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-870",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-104672",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-13994",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104672"
},
{
"db": "VULMON",
"id": "CVE-2017-13994"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
},
{
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: :\n1. A directory-traversal vulnerability\n2. An insufficient-entropy vulnerability\n3. An information-disclosure vulnerability\nAn attacker may leverage these issues to execute script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, execute arbitrary code within the context of the affected system or use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to read arbitrary files in the context of the application. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany. The vulnerability stems from the fact that the program does not fully authenticate Web requests",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-13994"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "VULHUB",
"id": "VHN-104672"
},
{
"db": "VULMON",
"id": "CVE-2017-13994"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-13994",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-17-257-01",
"trust": 2.9
},
{
"db": "BID",
"id": "100847",
"trust": 2.1
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-104672",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-13994",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104672"
},
{
"db": "VULMON",
"id": "CVE-2017-13994"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
},
{
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"id": "VAR-201710-0791",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-104672"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-20T23:22:10.059000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "https://www.loytec.com/jp/"
},
{
"title": "LOYTEC LVIS-3ME Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74975"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104672"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-257-01"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/100847"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13994"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13994"
},
{
"trust": 0.3,
"url": "https://www.loytec.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104672"
},
{
"db": "VULMON",
"id": "CVE-2017-13994"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
},
{
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-104672"
},
{
"db": "VULMON",
"id": "CVE-2017-13994"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
},
{
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-05T00:00:00",
"db": "VULHUB",
"id": "VHN-104672"
},
{
"date": "2017-10-05T00:00:00",
"db": "VULMON",
"id": "CVE-2017-13994"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"date": "2017-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-870"
},
{
"date": "2017-10-05T21:29:00.303000",
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-104672"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2017-13994"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008625"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-870"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-13994"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "LOYTEC LVIS-3ME Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008625"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-870"
}
],
"trust": 0.6
}
}
VAR-201710-0793
Vulnerability from variot - Updated: 2025-04-20 23:22A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code. LOYTEC LVIS-3ME Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: : 1. A directory-traversal vulnerability 2. An insufficient-entropy vulnerability 3. A cross-site scripting vulnerability 4. Versions prior to LVIS-3ME 6.2.0 are vulnerable. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany. There is a directory traversal vulnerability in LOYTEC LVIS-3ME versions before 6.2.0. The vulnerability stems from the fact that the program does not restrict non-administrator users from accessing important files
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0793",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lvis-3me",
"scope": "lte",
"trust": 1.0,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "lt",
"trust": 0.8,
"vendor": "loytec",
"version": "6.2.0"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.6,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.3,
"vendor": "loytec",
"version": "0"
},
{
"model": "lvis-3me",
"scope": "ne",
"trust": 0.3,
"vendor": "loytec",
"version": "6.2"
}
],
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
},
{
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:loytec:lvis-3me_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Davy Douhine of RandoriSec",
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
}
],
"trust": 0.9
},
"cve": "CVE-2017-13996",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2017-13996",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "VHN-104674",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-13996",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-13996",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-13996",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-868",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-104674",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-13996",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104674"
},
{
"db": "VULMON",
"id": "CVE-2017-13996"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
},
{
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code. LOYTEC LVIS-3ME Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: :\n1. A directory-traversal vulnerability\n2. An insufficient-entropy vulnerability\n3. A cross-site scripting vulnerability\n4. \nVersions prior to LVIS-3ME 6.2.0 are vulnerable. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany. There is a directory traversal vulnerability in LOYTEC LVIS-3ME versions before 6.2.0. The vulnerability stems from the fact that the program does not restrict non-administrator users from accessing important files",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-13996"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "VULHUB",
"id": "VHN-104674"
},
{
"db": "VULMON",
"id": "CVE-2017-13996"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "ICS CERT",
"id": "ICSA-17-257-01",
"trust": 2.9
},
{
"db": "NVD",
"id": "CVE-2017-13996",
"trust": 2.9
},
{
"db": "BID",
"id": "100847",
"trust": 2.1
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-104674",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-13996",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104674"
},
{
"db": "VULMON",
"id": "CVE-2017-13996"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
},
{
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"id": "VAR-201710-0793",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-104674"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-20T23:22:10.026000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "https://www.loytec.com/jp/"
},
{
"title": "LOYTEC LVIS-3ME Repair measures for path traversal vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74973"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.9
},
{
"problemtype": "CWE-23",
"trust": 1.0
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104674"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-257-01"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/100847"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13996"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13996"
},
{
"trust": 0.3,
"url": "https://www.loytec.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104674"
},
{
"db": "VULMON",
"id": "CVE-2017-13996"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
},
{
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-104674"
},
{
"db": "VULMON",
"id": "CVE-2017-13996"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
},
{
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-05T00:00:00",
"db": "VULHUB",
"id": "VHN-104674"
},
{
"date": "2017-10-05T00:00:00",
"db": "VULMON",
"id": "CVE-2017-13996"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"date": "2017-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-868"
},
{
"date": "2017-10-05T21:29:00.350000",
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-104674"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2017-13996"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-868"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-13996"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "LOYTEC LVIS-3ME Path traversal vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008626"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-868"
}
],
"trust": 0.6
}
}
VAR-201710-0795
Vulnerability from variot - Updated: 2025-04-20 23:22An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access. LOYTEC LVIS-3ME Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: : 1. A directory-traversal vulnerability 2. An insufficient-entropy vulnerability 3. A cross-site scripting vulnerability 4. An information-disclosure vulnerability An attacker may leverage these issues to execute script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, execute arbitrary code within the context of the affected system or use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0795",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lvis-3me",
"scope": "lte",
"trust": 1.0,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "lt",
"trust": 0.8,
"vendor": "loytec",
"version": "6.2.0"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.6,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.3,
"vendor": "loytec",
"version": "0"
},
{
"model": "lvis-3me",
"scope": "ne",
"trust": 0.3,
"vendor": "loytec",
"version": "6.2"
}
],
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
},
{
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:loytec:lvis-3me_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Davy Douhine of RandoriSec",
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
}
],
"trust": 0.9
},
"cve": "CVE-2017-13998",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "CVE-2017-13998",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "VHN-104676",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"id": "CVE-2017-13998",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-13998",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-13998",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-871",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-104676",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104676"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
},
{
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access. LOYTEC LVIS-3ME Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: :\n1. A directory-traversal vulnerability\n2. An insufficient-entropy vulnerability\n3. A cross-site scripting vulnerability\n4. An information-disclosure vulnerability\nAn attacker may leverage these issues to execute script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, execute arbitrary code within the context of the affected system or use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to read arbitrary files in the context of the application. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-13998"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "VULHUB",
"id": "VHN-104676"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-13998",
"trust": 2.8
},
{
"db": "ICS CERT",
"id": "ICSA-17-257-01",
"trust": 2.8
},
{
"db": "BID",
"id": "100847",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-104676",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104676"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
},
{
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"id": "VAR-201710-0795",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-104676"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-20T23:22:09.994000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "https://www.loytec.com/jp/"
},
{
"title": "LOYTEC LVIS-3ME Repair measures for information disclosure vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74976"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-522",
"trust": 1.1
},
{
"problemtype": "CWE-255",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104676"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-257-01"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/100847"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13998"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13998"
},
{
"trust": 0.3,
"url": "https://www.loytec.com/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104676"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
},
{
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-104676"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
},
{
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-05T00:00:00",
"db": "VULHUB",
"id": "VHN-104676"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"date": "2017-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-871"
},
{
"date": "2017-10-05T21:29:00.397000",
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-104676"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008627"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-871"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-13998"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "LOYTEC LVIS-3ME Vulnerabilities related to certificate and password management",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008627"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-871"
}
],
"trust": 0.6
}
}
VAR-201710-0789
Vulnerability from variot - Updated: 2025-04-20 23:22An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution. LOYTEC LVIS-3ME Contains a vulnerability related to lack of entropy.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: : 1. A directory-traversal vulnerability 2. An insufficient-entropy vulnerability 3. A cross-site scripting vulnerability 4. An information-disclosure vulnerability An attacker may leverage these issues to execute script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, execute arbitrary code within the context of the affected system or use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany. A remote attacker could exploit this vulnerability to execute code
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0789",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lvis-3me",
"scope": "lte",
"trust": 1.0,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "lt",
"trust": 0.8,
"vendor": "loytec",
"version": "6.2.0"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.6,
"vendor": "loytec",
"version": "6.1.1"
},
{
"model": "lvis-3me",
"scope": "eq",
"trust": 0.3,
"vendor": "loytec",
"version": "0"
},
{
"model": "lvis-3me",
"scope": "ne",
"trust": 0.3,
"vendor": "loytec",
"version": "6.2"
}
],
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
},
{
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:loytec:lvis-3me_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Davy Douhine of RandoriSec",
"sources": [
{
"db": "BID",
"id": "100847"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
}
],
"trust": 0.9
},
"cve": "CVE-2017-13992",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-13992",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-104670",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"id": "CVE-2017-13992",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-13992",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-13992",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-869",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-104670",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104670"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
},
{
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution. LOYTEC LVIS-3ME Contains a vulnerability related to lack of entropy.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOYTEC LVIS-3ME is prone to the following security vulnerabilities: :\n1. A directory-traversal vulnerability\n2. An insufficient-entropy vulnerability\n3. A cross-site scripting vulnerability\n4. An information-disclosure vulnerability\nAn attacker may leverage these issues to execute script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, execute arbitrary code within the context of the affected system or use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to read arbitrary files in the context of the application. LOYTEC LVIS-3ME is an HMI touch panel produced by LOYTEC in Germany. A remote attacker could exploit this vulnerability to execute code",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-13992"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "VULHUB",
"id": "VHN-104670"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-13992",
"trust": 2.8
},
{
"db": "ICS CERT",
"id": "ICSA-17-257-01",
"trust": 2.8
},
{
"db": "BID",
"id": "100847",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-104670",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104670"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
},
{
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"id": "VAR-201710-0789",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-104670"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-20T23:22:09.963000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "https://www.loytec.com/jp/"
},
{
"title": "LOYTEC LVIS-3ME Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74974"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-331",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104670"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-257-01"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/100847"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13992"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13992"
},
{
"trust": 0.3,
"url": "https://www.loytec.com/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-104670"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
},
{
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-104670"
},
{
"db": "BID",
"id": "100847"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
},
{
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-05T00:00:00",
"db": "VULHUB",
"id": "VHN-104670"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"date": "2017-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-869"
},
{
"date": "2017-10-05T21:29:00.240000",
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-104670"
},
{
"date": "2017-09-14T00:00:00",
"db": "BID",
"id": "100847"
},
{
"date": "2017-10-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008624"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-869"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-13992"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "LOYTEC LVIS-3ME Vulnerabilities related to lack of entropy",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008624"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "security feature problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-869"
}
],
"trust": 0.6
}
}