CVE-2018-5400

{"id": "CVE-2018-5400", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "cret@cert.org", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2018-10-08T15:29:02.727", "references": [{"url": "https://www.kb.cert.org/vuls/id/176301", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04", "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/176301", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-04", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-346"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, \"Hello World\" over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7."}, {"lang": "es", "value": "Los productos Auto-Maskin emplean un protocolo personalizado sin documentar para establecer comunicaciones Modbus con otros dispositivos sin validarlos. El dispositivo de origen env\u00eda un mensaje en texto plano, 48:65:6c:6c:6f:20:57:6f:72:6c:64, \"Hello World\" mediante los puertos UDP 44444-44446 a la direcci\u00f3n de retransmisi\u00f3n para el LAN. Sin verificaci\u00f3n, los dispositivos responden a cualquiera de estos mensajes de transmisi\u00f3n en la red LAN con una respuesta en texto plano mediante UDP conteniendo el modelo del dispositivo y la versi\u00f3n de firmware. Siguiendo este intercambio, los dispositivos permiten las transmisiones Modbus entre los dos dispositivos en el puerto Modbus est\u00e1ndar TCP 502. Impacto: un atacante puede explotar esta vulnerabilidad para enviar mensajes arbitrarios a cualquier dispositivo DCU o RP mediante ataques de suplantaci\u00f3n o reproducci\u00f3n durante el tiempo en el que tengan acceso a la red. Las versiones afectadas son Auto-Maskin DCU-210E RP-210E: versiones anteriores a la 3.7 en ARMv7."}], "lastModified": "2024-11-21T04:08:44.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:auto-maskin:rp_210e_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6276379-86DE-440E-88B1-E2B4AC1A1DD6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D64AEAAE-5F7C-43B9-AACA-39C927BDB5B4", "versionEndExcluding": "3.7"}, {"criteria": "cpe:2.3:h:auto-maskin:rp_210e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2B7F66D3-0436-4BF6-A177-C04C59BFAEE5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:auto-maskin:dcu_210e_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4121F18D-C67D-402B-85EB-7768BED46A82"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arm:arm7:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D64AEAAE-5F7C-43B9-AACA-39C927BDB5B4", "versionEndExcluding": "3.7"}, {"criteria": "cpe:2.3:h:auto-maskin:dcu_210e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "378677CF-D35D-4122-B481-3B7FCF6F4D27"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cret@cert.org"}