9.8

CVE-2018-8851

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store passwords in plaintext, which may allow an attacker with access to the configuration file to log into the SmartServer web user interface.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Echelon ≫ Smartserver 1 Firmware Version-
   Echelon ≫ Smartserver 1 Version-
Echelon ≫ Smartserver 2 Firmware Version < 4.11.007
   Echelon ≫ Smartserver 2 Version-
Echelon ≫ I.Lon 100 Firmware Version-
   Echelon ≫ I.Lon 100 Version-
Echelon ≫ I.Lon 600 Firmware Version-
   Echelon ≫ I.Lon 600 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.31% 0.676
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-256 Plaintext Storage of a Password

The product stores a password in plaintext within resources such as memory or files.

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03
Third Party Advisory
US Government Resource