What is the CVSS score of CVE-2013-2826?

CVE-2013-2826 has a CVSS 2.0 base score of 6.4 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2013-2826?

Yes, a patch is available for CVE-2013-2826. Update the affected software to the latest version immediately.

Kingalarm Event CVE-2013-2826

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2014-01-15 ics-cert@hq.dhs.gov

Privilege Escalation Kingalarm Event Kinggraphic Kingscada

6.4

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Jan 15, 2014 - 16:08 cve.org

MEDIUM 6.4

DescriptionCVE.org

WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 perform authentication on the KAEClientManager console rather than on the server, which allows remote attackers to bypass intended access restrictions and discover credentials via a crafted packet to TCP port 8130.

AnalysisAI

WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 perform authentication on the KAEClientManager console rather than on the server, which allows remote. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-264. WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 perform authentication on the KAEClientManager console rather than on the server, which allows remote attackers to bypass intended access restrictions and discover credentials via a crafted packet to TCP port 8130. Affected products include: Wellintech Kingalarm\&Event, Wellintech Kinggraphic, Wellintech Kingscada. Version information: before 3.1.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.