9.8

CVE-2018-20385

Exploit
CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNIT 125.553mp1.39219mp1.899.005ITT, CBW383G4J 37.556mp5.008, and CBW38G4J 37.553mp1.008 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Castlenet ≫ Cbv38z4ec Firmware Version 25.553mp1.39219mp1.899.007
   Castlenet ≫ Cbv38z4ec Version 1.0
Castlenet ≫ Cbv38z4ecnit Firmware Version 125.553mp1.39219mp1.899.005itt
   Castlenet ≫ Cbv38z4ecnit Version 1.0
Castlenet ≫ Cbw383g4j Firmware Version 37.556mp5.008
   Castlenet ≫ Cbw383g4j Version 1.01
Castlenet ≫ Cbw38g4j Firmware Version 37.553mp1.008
   Castlenet ≫ Cbw38g4j Version 1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.51% 0.712
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
Third Party Advisory
https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
Third Party Advisory
Exploit