Lucene search

[email protected]CVE-2012-3006

HistoryOct 03, 2022 - 4:15 p.m.

CVE-2012-3006

2022-10-0316:15:24

CWE-310

[email protected]

web.nvd.nist.gov

cve-2012-3006

mguard

innominate

smart hw

industrial rs

delta hw

pci

blade

eagle

entropy

private keys

man-in-the-middle

https

ssh

7.1 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:C/I:C/A:C

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

51.5%

JSON

The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.

Affected configurations

NVD

Node

innominatemguard_firmwareRange<7.5.0

AND

innominateeagle_mguard_bd-301010Match-

innominateeagle_mguard_hw-201000Match-

innominatemguard_blade_hw-104020Match-

innominatemguard_blade_hw-104050Match-

innominatemguard_delta_bd-201000Match-

innominatemguard_delta_hw-103050Match-

innominatemguard_industrial_rs_bd-501000Match-

innominatemguard_industrial_rs_bd-501010Match-

innominatemguard_industrial_rs_bd-501020Match-

innominatemguard_industrial_rs_hw-105000Match-

innominatemguard_pci_bd-111010Match-

innominatemguard_pci_bd-111020Match-

innominatemguard_pci_hw-102020Match-

innominatemguard_pci_hw-102050Match-

innominatemguard_smart_bd-101010Match-

innominatemguard_smart_bd-101020Match-

innominatemguard_smart_hw-101020Match-

innominatemguard_smart_hw-101050Match-

CPENameOperatorVersion
innominate:mguard_firmwareinnominate mguard firmwarelt7.5.0

CPE	Name	Operator	Version
innominate:mguard_firmware	innominate mguard firmware	lt	7.5.0

References

www.innominate.com/data/downloads/software/innominate_security_advisory_20120614_001.pdf

www.us-cert.gov/control_systems/pdf/ICSA-12-167-01.pdf

freedom-to-tinker.com/blog/nadiah/new-research-theres-no-need-panic-over-factorable-keys-just-mind-your-ps-and-qs

7.1 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:C/I:C/A:C

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

51.5%

JSON

Related for CVE-2012-3006

cvelist1 nvd1 prion1