CVE-2015-8288

NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://kb.netgear.com/app/answers/detail/a_id/30560	Vendor Advisory
http://www.kb.cert.org/vuls/id/778696	Third Party Advisory US Government Resource
http://kb.netgear.com/app/answers/detail/a_id/30560	Vendor Advisory
http://www.kb.cert.org/vuls/id/778696	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:d3600_firmware:1.0.0.49:*:*:*:*:*:*:*

cpe:2.3:h:netgear:d3600:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:netgear:d6000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:d6000:-:*:*:*:*:*:*:*

History

21 Nov 2024, 02:38

Type	Values Removed	Values Added
References	~~() http://kb.netgear.com/app/answers/detail/a_id/30560 - Vendor Advisory~~	() http://kb.netgear.com/app/answers/detail/a_id/30560 - Vendor Advisory
References	~~() http://www.kb.cert.org/vuls/id/778696 - Third Party Advisory, US Government Resource~~	() http://www.kb.cert.org/vuls/id/778696 - Third Party Advisory, US Government Resource

Information

Published : 2016-06-20 01:59

Updated : 2024-11-21 02:38

NVD link : CVE-2015-8288

Mitre link : CVE-2015-8288

CVE.ORG link : CVE-2015-8288

JSON object : View

Products Affected

netgear

d6000
d3600_firmware
d3600
d6000_firmware

CWE

NVD-CWE-Other

{"id": "CVE-2015-8288", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2016-06-20T01:59:00.133", "references": [{"url": "http://kb.netgear.com/app/answers/detail/a_id/30560", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/778696", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "http://kb.netgear.com/app/answers/detail/a_id/30560", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kb.cert.org/vuls/id/778696", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation."}, {"lang": "es", "value": "Dispositivos NETGEAR D3600 con firmware 1.0.0.49 y dispositivos D6000 con firmware 1.0.0.49 y versiones anteriores utilizan la misma clave privada embebida en instalaciones de clientes diferentes, lo que permite a a atacantes remotos vencer mecanismos de protecci\u00f3n criptogr\u00e1ficos aprovechando el conocimiento de esta clave de otra instalaci\u00f3n."}], "lastModified": "2024-11-21T02:38:14.440", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:d3600_firmware:1.0.0.49:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1BCBD82-9387-43D6-9759-4F878B22039E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:d3600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "31DE9D4E-3CDC-4552-A63F-DD5D95E23F63"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:d6000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EADFF4E4-8404-4EEA-8624-0C676B277FB1", "versionEndIncluding": "1.0.0.49"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:d6000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6F6EA344-FF99-4F27-9860-3C5BE07345A7"}], "operator": "OR"}], "operator": "AND"}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/321.html\">CWE-321: Use of Hard-coded Cryptographic Key</a>", "sourceIdentifier": "cret@cert.org"}