Lucene search

[email protected]CVE-2018-12336

HistoryJun 17, 2018 - 4:29 p.m.

CVE-2018-12336

2018-06-1716:29:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2018-12336

undocumented factory backdoor

ecos secure boot stick

sbs 5.6.5

vendor access

ssh

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.7%

JSON

Undocumented Factory Backdoor in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows the vendor to extract confidential information via remote root SSH access.

Affected configurations

NVD

Node

ecossecure_boot_stick_firmwareMatch5.6.5

AND

ecossecure_boot_stickMatch-

CPENameOperatorVersion
ecos:secure_boot_stick_firmwareecos secure boot stick firmwareeq5.6.5

CPE	Name	Operator	Version
ecos:secure_boot_stick_firmware	ecos secure boot stick firmware	eq	5.6.5

References

telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.7%

JSON

Related for CVE-2018-12336

cvelist1 nvd1 prion1