CVE-2018-17923

SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may able to reprogram it.

CVSS v3 6.9 MEDIUM
CVSS v2.0 6.9 MEDIUM

6.9^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability : 0.3 / Impact : 6.0

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/105729	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-296-02	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sagaradio:saga1-l8b_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sagaradio:saga1-l8b:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-10-24 22:29

Updated : 2024-02-28 16:48

NVD link : CVE-2018-17923

Mitre link : CVE-2018-17923

CVE.ORG link : CVE-2018-17923

JSON object : View

Products Affected

sagaradio

saga1-l8b
saga1-l8b_firmware

CWE

CWE-287

Improper Authentication

{"id": "CVE-2018-17923", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.9, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.3}]}, "published": "2018-10-24T22:29:01.150", "references": [{"url": "http://www.securityfocus.com/bid/105729", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-296-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may able to reprogram it."}, {"lang": "es", "value": "SAGA1-L8B con cualquier versi\u00f3n de firmware anterior a la A0.10 es vulnerable a un ataque que podr\u00eda permitir que un atacante con acceso f\u00edsico al producto lo reprograme."}], "lastModified": "2019-10-09T23:37:04.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sagaradio:saga1-l8b_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09F0FB47-A0F7-42F7-B7B4-AF1A7B2EB9D2", "versionEndExcluding": "a0.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sagaradio:saga1-l8b:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A1B937E7-9876-4EC6-8405-CA1A48458CFB"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}