CVE-2015-3959

{"id": "CVE-2015-3959", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-04T01:59:04.407", "references": [{"url": "http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.securityfocus.com/bid/75235", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password."}, {"lang": "es", "value": "Vulnerabilidad en el firmware de MNS en versiones anteriores a 4.5.6 en los switches Belden GarrettCom Magnum 6K y Magnum 10K, tiene una contrase\u00f1a embebida en una consola serie para una cuenta con privilegios, lo que podr\u00eda permitir a atacantes f\u00edsicamente pr\u00f3ximos obtener acceso mediante el inicio de una sesi\u00f3n en consola para una instalaci\u00f3n no est\u00e1ndar en la cual esta cuenta est\u00e9 habilitada, aprovechando el conocimiento de esta contrase\u00f1a."}], "lastModified": "2016-12-06T03:01:34.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:garrettcom:magnum_10k_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDC2AFA7-8A05-4CD0-9690-E89C2E238762", "versionEndIncluding": "4.5.5"}, {"criteria": "cpe:2.3:o:garrettcom:magnum_6k_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2523FB45-C5F4-4090-B01F-E75D795981FC", "versionEndIncluding": "4.5.5"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/798.html\" target=\"_blank\">CWE-798: Use of Hard-coded Credentials</a>", "sourceIdentifier": "ics-cert@hq.dhs.gov"}