What is the CVSS score of CVE-2016-4531?

CVE-2016-4531 has a CVSS 3.0 base score of 7.3 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 21.0%.

Factorytalk Energrymetrix CVE-2016-4531

HIGH

Improper Authorization (CWE-285)

2016-07-28 ics-cert@hq.dhs.gov

Rockwell Authentication Bypass Factorytalk Energrymetrix

7.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Jul 28, 2016 - 02:02 cve.org

HIGH 7.3

DescriptionCVE.org

AnalysisAI

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 21.0% and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-285. Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. Affected products include: Rockwellautomation Factorytalk Energrymetrix. Version information: before 2.20.00.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.