PT-2017-17864 · Eclipse · Kura

Dwoodard1 · Publicado 2017-09-11 · Atualizado 2017-09-29 · CVE-2017-7649

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kura versions prior to 2.1.0

Description The issue allows for unauthorized access to the device due to the Equinox console port 5002 being left open. This enables logging into Kura without user credentials over unencrypted telnet and executing commands using the Equinox exec command. As the process runs as root, full control over the device can be acquired. Additionally, IPv6 is left in auto-configuration mode, accepting router advertisements and assigning a MAC address-based IPv6 address.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the Equinox console port 5002 to prevent unauthorized access until a patch is available. Restrict access to the Equinox exec command to minimize the risk of exploitation. Avoid using unencrypted telnet for remote access until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-7649

Produtos afetados

Kura

Referências · 4

• https://github.com/eclipse/kura/issues/956 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7649 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7649 · Aviso do Fabricante
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681 · Nota