PT-2018-16943 · Auto Maskin+3 · Auto-Maskin Dcu-210E+3

Brian Olson + 1 · Published 2018-10-08 · Updated 2024-05-03 · CVE-2018-5399

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Auto-Maskin DCU-210E RP-210E versions prior to 3.7 on ARMv7

Description The firmware of the Auto-Maskin DCU 210E contains an undocumented Dropbear SSH server, version 2015.55, which listens on Port 22. This server is configured with a hard-coded username and password combination of root / amroot, and it uses password-only authentication. An attacker can exploit this issue to gain root access to the Angstrom Linux operating system, allowing modification of any binaries or configuration files in the firmware.

Recommendations For versions prior to 3.7 on ARMv7, update to version 3.7 or later to resolve the issue. As a temporary workaround, consider disabling the Dropbear SSH server until a patch is available. Restrict access to Port 22 to minimize the risk of exploitation. Avoid using the hard-coded username and password combination until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

ALT-PU-2022-2113

ALT-PU-2024-4252

ALT-PU-2024-7377

CVE-2018-5399

Affected Products

Alt Linux

Angstrom Linux

Auto-Maskin Dcu-210E

Dropbear Ssh Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-5399 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5399 · Vendor Advisory
• https://kb.cert.org/vuls/id/176301 · Note
• https://us-cert.gov/ics/advisories/icsa-20-051-04 · Note