CVE-2015-3971

Published: Oct 28, 2015Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute arbitrary JASIC code, via a session on TCP port 1239.

Affected (5)

Products: Janitza: Umg 508, Umg 509, Umg 511, Umg 604, Umg 605

5 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Janitza Umg 508	All versions
Janitza Umg 509	All versions
Janitza Umg 511	All versions
Janitza Umg 604	All versions
Janitza Umg 605	All versions

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03

Source: ics-cert@hq.dhs.gov

PatchThird Party AdvisoryUS Government Resource

https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.