Lucene search

[email protected]CVE-2018-12331

HistoryJun 17, 2018 - 4:29 p.m.

CVE-2018-12331

2018-06-1716:29:00

CWE-290

[email protected]

web.nvd.nist.gov

cve-2018-12331

authentication bypass

spoofing

ecos system management appliance

sma

easy enrollment

ip spoofing

configuration compromise

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.9%

JSON

Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to compromise authentication keys and configurations via IP spoofing during “Easy Enrollment.”

Affected configurations

NVD

Node

ecossystem_management_applianceMatch5.2.68

CPENameOperatorVersion
ecos:system_management_applianceecos system management applianceeq5.2.68

CPE	Name	Operator	Version
ecos:system_management_appliance	ecos system management appliance	eq	5.2.68

References

telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.9%

JSON

Related for CVE-2018-12331

nvd1 prion1 cvelist1