First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2017-13992

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	LOYTEC LVIS-3ME	LOYTEC LVIS-3ME

References

http://www.securityfocus.com/bid/100847Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-257-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/100847Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-257-01Third Party Advisory, US Government Resource

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-139937.8An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior version CVE-2017-139946.1A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validatio CVE-2017-1399510.0An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does n CVE-2017-139968.8A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to CVE-2017-139979.8A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch CVE-2017-139987.5An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficient CVE-2017-139999.8A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. Multiple stack-based buffer overflow vu CVE-2017-140009.4An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a speci CVE-2017-140018.8An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS comm CVE-2017-140029.8GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credenti CVE-2017-140039.8An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and p CVE-2017-140049.8GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful expl