8.8
CVE-2018-19023
- EPSS 0.26%
- Veröffentlicht 25.01.2019 20:29:00
- Zuletzt bearbeitet 21.11.2024 03:57:11
- Quelle ics-cert@hq.dhs.gov
- CVE-Watchlists
- Unerledigt
LoginHetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hetronic ≫ Nova-m Firmware Version < r161
Hetronic ≫ Es-can-hl Firmware Version < main_r1864
Hetronic ≫ Bms-hl Firmware Version < main_r1175
Hetronic ≫ Mlc Firmware Version < main_r1600
Hetronic ≫ Dc Mobile Firmware Version < main_r515
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.26% | 0.491 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 5.8 | 6.5 | 6.4 |
AV:A/AC:L/Au:N/C:P/I:P/A:P
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-294 Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).