CVE:CVE-2014-9201
CNNVD:CNNVD-201506-060
Beckwith Electric M-6200 Digital Voltage Regulator Control等都是美国Beckwith Electric公司的通用变压器有载分接开关控制器产品。
多款Beckwith Electric产品中存在安全绕过漏洞，该漏洞源于程序没有正确生成TCP initial sequence number(ISN)值。远程攻击者可通过预测ISN值利用该漏洞伪造TCP会话。以下产品及版本受到影响：使用D-0198V04.07.00之前版本固件的Beckwith Electric M-6200 Digital Voltage Regulator Control，使用D-0228V02.01.07之前版本固件的M-6200A Digital Voltage Regulator Control，使用D-0214V01.10.04之前版本固件的M-2001D Digital Tapchanger Control，使用D-0346V03.00.02之前版本固件的M-6283A Three Phase Digital Capacitor Bank Control，使用D-0254V03.05.05之前版本固件的M-6280A Digital Capacitor Bank Control，M-6280 Digital Capacitor Bank Control。
solution:Upgrade beckwithelectric m-2001d_digital_tapchanger_control to a higher version than -; Upgrade beckwithelectric m-6200_digital_voltage_regulator_control to a higher version than -; Upgrade beckwithelectric m-6200a_digital_voltage_regulator_control to a higher version than -; Upgrade beckwithelectric m-6280_digital_capacitor_bank_control to a higher version than -; Upgrade beckwithelectric m-6280a_digital_capacitor_bank_control to a higher version than -; Upgrade beckwithelectric m-6283a_three_phase_digital_capacitor_bank_control to a higher version than -; Upgrade beckwithelectric m-2001d_digital_tapchanger_control_d-0214_firmware to a higher version than 01.10.04,and avoid the version (,01.10.04]; Upgrade beckwithelectric m-6200_digital_voltage_regulator_control_d-0198_firmware to a higher version than 04.07.00,and avoid the version (,04.07.00]; Upgrade beckwithelectric m-6200a_digital_voltage_regulator_control_d-0228_firmware to a higher version than 02.01.07,and avoid the version (,02.01.07]; Upgrade beckwithelectric m-6280_digital_capacitor_bank_control_firmware to a higher version than -; Upgrade beckwithelectric m-6280a_digital_capacitor_bank_control_d-0254_firmware to a higher version than 03.05.05,and avoid the version (,03.05.05]; Upgrade beckwithelectric m-6283a_three_phase_digital_capacitor_bank_control_d-0346_firmware to a higher version than 03.00.02,and avoid the version (,03.00.02]