PT-2013-2123 · Digital Alert Systems+1 · Dasdec+1

Cesar Cerrudo + 1 · Published 2013-06-29 · Updated 2020-01-29 · CVE-2013-0137

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Digital Alert Systems DASDEC EAS device versions prior to 2.0-2 Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2

Description The default configuration of the affected devices contains a known SSH private key, allowing remote attackers to obtain root access and spoof alerts via an SSH session.

Recommendations For Digital Alert Systems DASDEC EAS device versions prior to 2.0-2, update to version 2.0-2 or later to resolve the issue. For Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2, update to version 2.0-2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-0137

Affected Products

Dasdec

R189 One-Net

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-0137 · Security Note
• http://digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf · Vendor Advisory
• http://monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf · Vendor Advisory
• https://securityledger.com/2020/01/seven-years-later-scores-of-eas-systems-sit-un-patched-vulnerable · Note
• http://kb.cert.org/vuls/id/AAMN-98MU7H · Note
• http://kb.cert.org/vuls/id/AAMN-98MUK2 · Note
• http://kb.cert.org/vuls/id/662676 · Note