CVE-2018-15781

The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover the hard coded private key and decrypt locally stored cipher text.

CVSS v3 7.9 HIGH
CVSS v2.0 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector : AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.9^/10

CVSS v2.0 : HIGH

Vector : AV:A/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 5.5 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.dell.com/support/article/SLN316104	Patch Vendor Advisory
https://www.dell.com/support/article/SLN316104	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:wyse_thinlinux:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:51

Type	Values Removed	Values Added
References	~~() https://www.dell.com/support/article/SLN316104 - Patch, Vendor Advisory~~	() https://www.dell.com/support/article/SLN316104 - Patch, Vendor Advisory
CVSS	v2 : ~~7.9~~ v3 : ~~8.0~~	v2 : 7.9 v3 : 7.9

Information

Published : 2019-02-13 16:29

Updated : 2024-11-21 03:51

NVD link : CVE-2018-15781

Mitre link : CVE-2018-15781

CVE.ORG link : CVE-2018-15781

JSON object : View

Products Affected

dell

wyse_thinlinux

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2018-15781", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.9, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2019-02-13T16:29:00.297", "references": [{"url": "https://www.dell.com/support/article/SLN316104", "tags": ["Patch", "Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/article/SLN316104", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover the hard coded private key and decrypt locally stored cipher text."}, {"lang": "es", "value": "El codificador de contrase\u00f1as Dell Wyse en ThinLinux2, en versiones anteriores a la 2.1.0.01, contiene una vulnerabilidad de clave criptogr\u00e1fica embebida. Un atacante remoto no autenticado podr\u00eda emplear ingenier\u00eda inversa en el sistema criptogr\u00e1fico empleado en el codificador de contrase\u00f1as Dell Wyse para descubrir la clave privada embebida y descifrar el texto cifrado almacenado de forma local."}], "lastModified": "2024-11-21T03:51:27.333", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:wyse_thinlinux:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B037DC6F-7442-4CFC-B6CE-1F2B2362C5E7", "versionEndExcluding": "2.1.0.01", "versionStartIncluding": "2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}