CVE-2017-9137

Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account established by the vendor). This account can be accessed via both the web interface and SSH. In the web interface, this simply grants an attacker read-only access to the device's settings. However, when using SSH, this gives an attacker access to a Linux shell. NOTE: the vendor has commented "The mateidu user is a known user, which is mentioned in the FibeAir IP-10 User Guide. Customers are instructed to change the mateidu user password. Changing the user password fully solves the vulnerability."

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://blog.iancaling.com/post/160817658078	Third Party Advisory
http://blog.iancaling.com/post/160817658078	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:ceragon:fiberair_ip-10_firmware:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:35

Type	Values Removed	Values Added
References	~~() http://blog.iancaling.com/post/160817658078 - Third Party Advisory~~	() http://blog.iancaling.com/post/160817658078 - Third Party Advisory

Information

Published : 2017-05-21 21:29

Updated : 2024-11-21 03:35

NVD link : CVE-2017-9137

Mitre link : CVE-2017-9137

CVE.ORG link : CVE-2017-9137

JSON object : View

Products Affected

ceragon

fiberair_ip-10_firmware

CWE

CWE-1188

Insecure Default Initialization of Resource

{"id": "CVE-2017-9137", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2017-05-21T21:29:00.410", "references": [{"url": "http://blog.iancaling.com/post/160817658078", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://blog.iancaling.com/post/160817658078", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account established by the vendor). This account can be accessed via both the web interface and SSH. In the web interface, this simply grants an attacker read-only access to the device's settings. However, when using SSH, this gives an attacker access to a Linux shell. NOTE: the vendor has commented \"The mateidu user is a known user, which is mentioned in the FibeAir IP-10 User Guide. Customers are instructed to change the mateidu user password. Changing the user password fully solves the vulnerability.\""}, {"lang": "es", "value": "Las radios inal\u00e1mbricas Ceragon FibeAir IP-10 hasta la versi\u00f3n 7.2.0, presentan una contrase\u00f1a por defecto mateidu para la cuenta mateidu (una cuenta de usuario oculta establecida por el proveedor). Esta cuenta puede ser accedida por medio de la interfaz web y SSH. En la interfaz web, esto simplemente otorga a un atacante acceso de solo lectura a la configuraci\u00f3n del dispositivo. Sin embargo, cuando se usa SSH, esto le da a un atacante acceso a un shell de Linux. NOTA: el proveedor ha comentado \"El usuario de mateidu es un usuario conocido, que es mencionado en la Gu\u00eda de Usuario de FibeAir IP-10. Los usuarios est\u00e1n instruidos a cambiar la contrase\u00f1a de usuario de mateidu. Cambiando la contrase\u00f1a de usuario se resuelve completamente la vulnerabilidad\"."}], "lastModified": "2024-11-21T03:35:24.427", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ceragon:fiberair_ip-10_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C6BB3E2-8AF2-445F-AA41-42B86ADC2B06", "versionEndIncluding": "7.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}