Vulnerability Note VU#154307

Synel SY-780/A terminal denial-of-service vulnerability

Original Release date: 09 Jul 2012 | Last revised: 09 Jul 2012

Overview

Synel SY-780/A terminals contain a denial-of-service vulnerability when specific ports of the device are scanned.

Description

According to Synel's website the SY-780/A terminal is a stand-alone device used for time & attendance monitoring, production floor control, job costing, and access control applications. It has been reported that performing a port or vulnerability scan against this device or specifically hitting ports 1641, 3734 or 3735, will cause the device to stop responding completely.

Impact

If an attacker performs a port scan on the SY-780/A terminal, that attacker can completely lock the device, making the device inaccessible.

Solution

We are currently unaware of a practical solution to this problem.

Restrict network access

As a general good security practice, only allow connections from trusted hosts and networks.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
SynelAffected-29 Jun 2012
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C
Temporal 6.3 E:F/RL:W/RC:UC
Environmental 1.9 CDP:LM/TD:L/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to the reporter that wishes to remain anonymous.

This document was written by Michael Orlando.

Other Information

  • CVE IDs: CVE-2012-2970
  • Date Public: 09 Jul 2012
  • Date First Published: 09 Jul 2012
  • Date Last Updated: 09 Jul 2012
  • Document Revision: 12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.