Executive Summary

Summary
Title Synel SY-780/A terminal denial-of-service vulnerability
Informations
Name VU#154307 First vendor Publication 2012-07-09
Vendor VU-CERT Last vendor Modification 2012-07-09
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#154307

Synel SY-780/A terminal denial-of-service vulnerability

Original Release date: 09 Jul 2012 | Last revised: 09 Jul 2012

Overview

Synel SY-780/A terminals contain a denial-of-service vulnerability when specific ports of the device are scanned.

Description

According to Synel's website the SY-780/A terminal is a stand-alone device used for time & attendance monitoring, production floor control, job costing, and access control applications. It has been reported that performing a port or vulnerability scan against this device or specifically hitting ports 1641, 3734 or 3735, will cause the device to stop responding completely.

Impact

If an attacker performs a port scan on the SY-780/A terminal, that attacker can completely lock the device, making the device inaccessible.

Solution

We are currently unaware of a practical solution to this problem.

Restrict network access

As a general good security practice, only allow connections from trusted hosts and networks.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
SynelAffected-29 Jun 2012
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base7.8AV:N/AC:L/Au:N/C:N/I:N/A:C
Temporal6.3E:F/RL:W/RC:UC
Environmental1.9CDP:LM/TD:L/CR:ND/IR:ND/AR:ND

References

  • http://www.synel.com/time-and-attendance/sy-780a.html

Credit

Thanks to the reporter that wishes to remain anonymous.

This document was written by Michael Orlando.

Other Information

  • CVE IDs:CVE-2012-2970
  • Date Public:09 Jul 2012
  • Date First Published:09 Jul 2012
  • Date Last Updated:09 Jul 2012
  • Document Revision:12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

This product is provided subject to the Notification as indicated here: http://www.us-cert.gov/legal.html#notify

Original Source

Url : http://www.kb.cert.org/vuls/id/154307

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-399 Resource Management Errors

CPE : Common Platform Enumeration

TypeDescriptionCount
Hardware 1