CVE-2012-4898

Mesh OS before 7.9.1.1 on Tropos wireless mesh routers does not use a sufficient source of entropy for SSH keys, which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation elsewhere.

CVSS v2.0 6.1 MEDIUM

6.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:C/I:P/A:N

Exploitability : 4.9 / Impact : 7.8

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-297-01.pdf	US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tropos:mesh_os:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:tropos:1310_distrubution_automation_mesh_router:-:::::::*
	cpe:2.3:h:tropos:1410_mesh_router:-:::::::*
	cpe:2.3:h:tropos:1410_wireless_mesh_router:-:::::::*
	cpe:2.3:h:tropos:3310_indoor_mesh_router:-:::::::*
	cpe:2.3:h:tropos:3320_indoor_mesh_router:-:::::::*
	cpe:2.3:h:tropos:4310_mobile_mesh_router:-:::::::*
	cpe:2.3:h:tropos:6310_mesh_router:-:::::::*
	cpe:2.3:h:tropos:6320_mesh_router:-:::::::*

History

No history.

Information

Published : 2012-12-18 12:30

Updated : 2024-02-28 12:00

NVD link : CVE-2012-4898

Mitre link : CVE-2012-4898

CVE.ORG link : CVE-2012-4898

JSON object : View

Products Affected

tropos

4310_mobile_mesh_router
mesh_os
6320_mesh_router
3320_indoor_mesh_router
1310_distrubution_automation_mesh_router
1410_wireless_mesh_router
3310_indoor_mesh_router
6310_mesh_router
1410_mesh_router

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2012-4898", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 7.8, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-12-18T12:30:05.920", "references": [{"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-297-01.pdf", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "Mesh OS before 7.9.1.1 on Tropos wireless mesh routers does not use a sufficient source of entropy for SSH keys, which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation elsewhere."}, {"lang": "es", "value": "Mesh OS antes de v7.9.1.1 en los routers Tropos inal\u00e1mbricos no utilizan una fuente suficiente de entrop\u00eda para claves SSH, lo que hace que sea m\u00e1s f\u00e1cil para atacantes man-in-the-middle falsificar un dispositivo o modificar un flujo de datos cliente-servidor mediante el aprovechamiento de conocimiento de una clave de una instalaci\u00f3n del producto en otros lugares."}], "lastModified": "2013-01-29T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tropos:mesh_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E8693B2-5D42-46A1-9994-42E5BADCAB75", "versionEndIncluding": "7.9.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tropos:1310_distrubution_automation_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7852E70-8D02-482E-95FB-2E0CA77E17B4"}, {"criteria": "cpe:2.3:h:tropos:1410_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E27A596C-9AB4-47FB-8CC1-A442AE2B166B"}, {"criteria": "cpe:2.3:h:tropos:1410_wireless_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A03DF812-5697-4216-B34A-68F862258BB4"}, {"criteria": "cpe:2.3:h:tropos:3310_indoor_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB430981-1D88-4C92-BC7E-A6AFA1525A76"}, {"criteria": "cpe:2.3:h:tropos:3320_indoor_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B9E51A6-A559-4113-A7C6-EE3C7DF1B5EE"}, {"criteria": "cpe:2.3:h:tropos:4310_mobile_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "668A0BBA-9F67-4E63-A2CE-7A114B42E58F"}, {"criteria": "cpe:2.3:h:tropos:6310_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E564CC3-C509-428D-AEB4-8F100ECFF0B3"}, {"criteria": "cpe:2.3:h:tropos:6320_mesh_router:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FA11508-E41A-431A-9386-7D8A95C0D8D6"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}