Lucene search

IcscertCVE-2017-6046

HistoryJun 30, 2017 - 3:29 a.m.

CVE-2017-6046

2017-06-3003:29:00

CWE-522

CWE-200

icscert

web.nvd.nist.gov

sierra wireless

airlink raven xe

airlink raven xt

cve-2017-6046

insufficiently protected credentials

information disclosure

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

43.3%

JSON

An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Sensitive information is insufficiently protected during transmission and vulnerable to sniffing, which could lead to information disclosure.

Affected configurations

Nvd

Node

sierra_wirelessairlink_raven_xe_firmwareRange≤-

AND

sierra_wirelessairlink_raven_xeMatch-

Node

sierra_wirelessairlink_raven_xt_firmwareMatch-

AND

sierra_wirelessairlink_raven_xtMatch-

VendorProductVersionCPE
sierra_wirelessairlink_raven_xe_firmware*cpe:2.3:o:sierra_wireless:airlink_raven_xe_firmware:*:*:*:*:*:*:*:*
sierra_wirelessairlink_raven_xe-cpe:2.3:h:sierra_wireless:airlink_raven_xe:-:*:*:*:*:*:*:*
sierra_wirelessairlink_raven_xt_firmware-cpe:2.3:o:sierra_wireless:airlink_raven_xt_firmware:-:*:*:*:*:*:*:*
sierra_wirelessairlink_raven_xt-cpe:2.3:h:sierra_wireless:airlink_raven_xt:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sierra_wireless	airlink_raven_xe_firmware	*	cpe:2.3:o:sierra_wireless:airlink_raven_xe_firmware::::::::
sierra_wireless	airlink_raven_xe	-	cpe:2.3:h:sierra_wireless:airlink_raven_xe:-:::::::*
sierra_wireless	airlink_raven_xt_firmware	-	cpe:2.3:o:sierra_wireless:airlink_raven_xt_firmware:-:::::::*
sierra_wireless	airlink_raven_xt	-	cpe:2.3:h:sierra_wireless:airlink_raven_xt:-:::::::*

CNA Affected

[
  {
    "product": "Sierra Wireless AirLink Raven XE and XT",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Sierra Wireless AirLink Raven XE and XT"
      }
    ]
  }
]

References

www.securityfocus.com/bid/98036

ics-cert.us-cert.gov/advisories/ICSA-17-115-02

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

43.3%

JSON

Related for CVE-2017-6046