9.8

CVE-2018-8851

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store passwords in plaintext, which may allow an attacker with access to the configuration file to log into the SmartServer web user interface.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Echelon ≫ Smartserver 1 Firmware Version-
   Echelon ≫ Smartserver 1 Version-
Echelon ≫ Smartserver 2 Firmware Version < 4.11.007
   Echelon ≫ Smartserver 2 Version-
Echelon ≫ I.Lon 100 Firmware Version-
   Echelon ≫ I.Lon 100 Version-
Echelon ≫ I.Lon 600 Firmware Version-
   Echelon ≫ I.Lon 600 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.448
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-256 Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03
Third Party Advisory
US Government Resource