Lucene search

MitreCVE-2018-16705

HistorySep 10, 2018 - 5:29 p.m.

CVE-2018-16705

2018-09-1017:29:00

CWE-200

mitre

web.nvd.nist.gov

furuno

felcom

cve-2018-16705

unauthenticated access

sensitive data

security vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.015

Percentile

87.2%

JSON

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system’s usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext.

Affected configurations

Nvd

Node

furunofelcom_250_firmwareMatch-

AND

furunofelcom_250Match-

Node

furunofelcom_500_firmwareMatch-

AND

furunofelcom_500Match-

VendorProductVersionCPE
furunofelcom_250_firmware-cpe:2.3:o:furuno:felcom_250_firmware:-:*:*:*:*:*:*:*
furunofelcom_250-cpe:2.3:h:furuno:felcom_250:-:*:*:*:*:*:*:*
furunofelcom_500_firmware-cpe:2.3:o:furuno:felcom_500_firmware:-:*:*:*:*:*:*:*
furunofelcom_500-cpe:2.3:h:furuno:felcom_500:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
furuno	felcom_250_firmware	-	cpe:2.3:o:furuno:felcom_250_firmware:-:::::::*
furuno	felcom_250	-	cpe:2.3:h:furuno:felcom_250:-:::::::*
furuno	felcom_500_firmware	-	cpe:2.3:o:furuno:felcom_500_firmware:-:::::::*
furuno	felcom_500	-	cpe:2.3:h:furuno:felcom_500:-:::::::*

References

cyberskr.com/blog/furuno-felcom.html

gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.015

Percentile

87.2%

JSON

Related for CVE-2018-16705