title: Baker Hughes Bently Nevada 3500 System Exposure of Sensitive Information to an Unauthorized Actor
description:
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05
contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: Bently Nevada 3500 System
vendor: Baker Hughes - Bently Nevada
versions:
status: affected, version: 5.05
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds: Baker Hughes – Bently Nevada recommends that users follow their
hardening guidelines to reduce the risk of exploitation. Customers who
have registered for access to Baker Hughes DAM may directly access the
hardening guideline at  https://dam.bakerhughes.com/media/?mediaId=32F7FC2F-9F22-4C69-BB847565B7834D08 https://dam.bakerhughes.com/media/ .For customers that do not have access to Baker Hughes DAM may send an email to bentlysupport@bakerhughes.com to request document 106M9733.