Lucene search

MitreCVE-2018-18960

HistoryDec 24, 2018 - 5:29 p.m.

CVE-2018-18960

2018-12-2417:29:00

CWE-400

mitre

web.nvd.nist.gov

epson workforce wf-2861

snmp

vulnerability

network attack

amplification

cve-2018-18960

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP to find certain devices on the network, but the default version is v2c, allowing an amplification attack.

Affected configurations

Nvd

Node

epsonepson_workforce_wf-2861_firmwareMatch10.48_lq22i3

epsonepson_workforce_wf-2861_firmwareMatch10.51.lq20i6

epsonepson_workforce_wf-2861_firmwareMatch10.52.lq17ia

AND

epsonepson_workforce_wf-2861Match-

VendorProductVersionCPE
epsonepson_workforce_wf-2861_firmware10.48_lq22i3cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.48_lq22i3:*:*:*:*:*:*:*
epsonepson_workforce_wf-2861_firmware10.51.lq20i6cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.51.lq20i6:*:*:*:*:*:*:*
epsonepson_workforce_wf-2861_firmware10.52.lq17iacpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.52.lq17ia:*:*:*:*:*:*:*
epsonepson_workforce_wf-2861-cpe:2.3:h:epson:epson_workforce_wf-2861:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
epson	epson_workforce_wf-2861_firmware	10.48_lq22i3	cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.48_lq22i3:::::::*
epson	epson_workforce_wf-2861_firmware	10.51.lq20i6	cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.51.lq20i6:::::::*
epson	epson_workforce_wf-2861_firmware	10.52.lq17ia	cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.52.lq17ia:::::::*
epson	epson_workforce_wf-2861	-	cpe:2.3:h:epson:epson_workforce_wf-2861:-:::::::*

References

github.com/epistemophilia/CVEs/blob/master/Epson-WorkForce-WF2861/CVE-2018-18960/poc-cve-2018-18960.py

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

Related for CVE-2018-18960