CVE-2017-7237 - The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69, as demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file

Back Back to CVE browser

CRITICAL

The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69, as demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file

Published Apr 6, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 6.72%

Description

The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69, as demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (4)

http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt
x_refsource_MISCExploitThird Party Advisory
https://community.spiceworks.com/support/inventory/docs/network-config#security
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-16269
Advisory
https://www.exploit-db.com/exploits/41825/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt		x_refsource_MISCExploitThird Party Advisory
https://community.spiceworks.com/support/inventory/docs/network-config#security		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-16269		Advisory
https://www.exploit-db.com/exploits/41825/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry