9.8

CVE-2018-8855

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Echelon ≫ Smartserver 1 Firmware Version-
   Echelon ≫ Smartserver 1 Version-
Echelon ≫ Smartserver 2 Firmware Version < 4.11.007
   Echelon ≫ Smartserver 2 Version-
Echelon ≫ I.Lon 100 Firmware Version-
   Echelon ≫ I.Lon 100 Version-
Echelon ≫ I.Lon 600 Firmware Version-
   Echelon ≫ I.Lon 600 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.526
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03
Third Party Advisory
US Government Resource