9.8

CVE-2018-20385

Exploit
CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNIT 125.553mp1.39219mp1.899.005ITT, CBW383G4J 37.556mp5.008, and CBW38G4J 37.553mp1.008 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Castlenet ≫ Cbv38z4ec Firmware Version25.553mp1.39219mp1.899.007
   Castlenet ≫ Cbv38z4ec Version1.0
Castlenet ≫ Cbv38z4ecnit Firmware Version125.553mp1.39219mp1.899.005itt
   Castlenet ≫ Cbv38z4ecnit Version1.0
Castlenet ≫ Cbw383g4j Firmware Version37.556mp5.008
   Castlenet ≫ Cbw383g4j Version1.01
Castlenet ≫ Cbw38g4j Firmware Version37.553mp1.008
   Castlenet ≫ Cbw38g4j Version1.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.682
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.