9.8

CVE-2018-8855

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Echelon ≫ Smartserver 1 Firmware Version-
   Echelon ≫ Smartserver 1 Version-
Echelon ≫ Smartserver 2 Firmware Version < 4.11.007
   Echelon ≫ Smartserver 2 Version-
Echelon ≫ I.Lon 100 Firmware Version-
   Echelon ≫ I.Lon 100 Version-
Echelon ≫ I.Lon 600 Firmware Version-
   Echelon ≫ I.Lon 600 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.355
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03
Third Party Advisory
US Government Resource