Lucene search

IcscertCVE-2021-33017

HistoryDec 27, 2021 - 7:15 p.m.

CVE-2021-33017

2021-12-2719:15:08

CWE-288

icscert

web.nvd.nist.gov

intellibridge

ec 40

ec 60

hub

authentication bypass

vulnerability

nvd

cve-2021-33017

CVSS2

5.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

29.4%

JSON

The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.

Affected configurations

Nvd

Node

philipsintellibridge_ec40_firmwareRange≤c.00.04

AND

philipsintellibridge_ec40Match-

Node

philipsintellibridge_ec80_firmwareRange≤c.00.04

AND

philipsintellibridge_ec80Match-

VendorProductVersionCPE
philipsintellibridge_ec40_firmware*cpe:2.3:o:philips:intellibridge_ec40_firmware:*:*:*:*:*:*:*:*
philipsintellibridge_ec40-cpe:2.3:h:philips:intellibridge_ec40:-:*:*:*:*:*:*:*
philipsintellibridge_ec80_firmware*cpe:2.3:o:philips:intellibridge_ec80_firmware:*:*:*:*:*:*:*:*
philipsintellibridge_ec80-cpe:2.3:h:philips:intellibridge_ec80:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
philips	intellibridge_ec40_firmware	*	cpe:2.3:o:philips:intellibridge_ec40_firmware::::::::
philips	intellibridge_ec40	-	cpe:2.3:h:philips:intellibridge_ec40:-:::::::*
philips	intellibridge_ec80_firmware	*	cpe:2.3:o:philips:intellibridge_ec80_firmware::::::::
philips	intellibridge_ec80	-	cpe:2.3:h:philips:intellibridge_ec80:-:::::::*

CNA Affected

[
  {
    "product": "IntelliBridge EC 40 Hub",
    "vendor": "Philips",
    "versions": [
      {
        "lessThanOrEqual": "C.00.04",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "IntelliBridge EC 80 Hub",
    "vendor": "Philips",
    "versions": [
      {
        "lessThanOrEqual": "C.00.04",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsma-21-322-01

CVSS2

5.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

29.4%

JSON

Related for CVE-2021-33017