27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

<strong>PVS</strong> ID: 3853 FAMILY: SCADA RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is configured with default or easily-guessed<br />

credentials.\n\nThe ethernet module on Modicon's Quantum, Premium and Micro PLC's<br />

has an HTTP server with one account that can be modified. The default account has the<br />

ability to load programs and change the configuration and programming of the PLC.<br />

Solution: Change the username and password for the HTTP server.<br />

CVE Not available<br />

Modicon PLC Telnet Server Detection (SCADA)<br />

<strong>PVS</strong> ID: 3854 FAMILY: SCADA RISK: HIGH NESSUS ID:Not Available<br />

Description: The remote host is a Modicon PLC Telnet server.<br />

Solution: Restrict access to the affected port on the PLC or change the default credentials.<br />

CVE Not available<br />

Modicon PLC CPU Type Default Credentials (SCADA)<br />

<strong>PVS</strong> ID: 3855 FAMILY: SCADA<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is configured with default or easily-guessed<br />

credentials.\n\nThe Modicon Quantum, Premium and Momentum brands of PLCs have a<br />

private SNMP MIB that is available on the Internet. The type of Modicon PLC may be<br />

obtained via an SNMP Get Request.<br />

Solution: Change default community strings to a value not easily guessed and filter access to the<br />

SNMP port.<br />

CVE Not available<br />

Modicon PLC IO Scan Status Disclosure<br />

<strong>PVS</strong> ID: 3856 FAMILY: Generic<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host may give an attacker information useful for future<br />

attacks.\n\nThe Modicon Quantum, Premium and Momentum brands of PLCs have a<br />

private SNMP MIB that is available on the Internet. The scan status may be obtained via an<br />

SNMP Get Request. The scan status is either idle, operational or stopped. An attacker may<br />

use this information to determine the status of a PLC.<br />

Solution: Change default community strings to a value not easily guessed and filter access to the<br />

SNMP port.<br />

Family Internet Services 997

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!