9.8

CVE-2018-10618

Exploit
Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Davolink ≫ Dvw-3200n Firmware Version < 1.00.06
   Davolink ≫ Dvw-3200n Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 18.52% 0.951
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-916 Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

http://www.securityfocus.com/bid/104940
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-212-01
Third Party Advisory
US Government Resource
Mitigation
https://www.exploit-db.com/exploits/45076/
Third Party Advisory
Exploit
VDB Entry