CVE-2017-6094

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value (48bit) derived from the MAC. The algorithm used to compute the "chk" was disclosed by reverse engineering the CPE's firmware. As a result, it is possible to forge valid "chk" values for any given MAC address and therefore receive the configuration settings of other subscribers' CPEs. The configuration settings often contain sensitive values, for example credentials (username/password) for VoIP services. This issue affects Genexis B.V. GAPS up to 7.2.

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://seclists.org/fulldisclosure/2017/Dec/62	Exploit Mailing List Mitigation Third Party Advisory
http://seclists.org/fulldisclosure/2017/Dec/62	Exploit Mailing List Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:genexis:gaps:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:29

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2017/Dec/62 - Exploit, Mailing List, Mitigation, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2017/Dec/62 - Exploit, Mailing List, Mitigation, Third Party Advisory

Information

Published : 2017-12-20 20:29

Updated : 2024-11-21 03:29

NVD link : CVE-2017-6094

Mitre link : CVE-2017-6094

CVE.ORG link : CVE-2017-6094

JSON object : View

Products Affected

genexis

gaps

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2017-6094", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-12-20T20:29:00.573", "references": [{"url": "http://seclists.org/fulldisclosure/2017/Dec/62", "tags": ["Exploit", "Mailing List", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2017/Dec/62", "tags": ["Exploit", "Mailing List", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain \"chk\" value (48bit) derived from the MAC. The algorithm used to compute the \"chk\" was disclosed by reverse engineering the CPE's firmware. As a result, it is possible to forge valid \"chk\" values for any given MAC address and therefore receive the configuration settings of other subscribers' CPEs. The configuration settings often contain sensitive values, for example credentials (username/password) for VoIP services. This issue affects Genexis B.V. GAPS up to 7.2."}, {"lang": "es", "value": "Los CPE utilizados por los suscriptores en la red de acceso reciben su configuraci\u00f3n individual desde una instancia GAPS central. Un CPE se identifica por la direcci\u00f3n MAC de su interfaz WAN y un valor determinado \"chk\" (48bit) derivado del MAC. El algoritmo utilizado para calcular el \"chk\" fue revelado mediante ingenier\u00eda inversa en el firmware del CPE. Como resultado, es posible forjar valores \"chk\" v\u00e1lidos para cualquier direcci\u00f3n MAC dada y por lo tanto recibir los ajustes de configuraci\u00f3n de CPE de otros suscriptores. Los ajustes de configuraci\u00f3n suelen contener valores sensibles, por ejemplo, credenciales (nombre de usuario/contrase\u00f1a) para servicios VoIP. Esta situaci\u00f3n afecta a Genexis B. V. GAPS hasta la versi\u00f3n 7.2."}], "lastModified": "2024-11-21T03:29:04.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:genexis:gaps:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B390447F-1540-4A24-AD01-57E95DF00953", "versionEndExcluding": "7.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}