CVE-2017-7649
CVSS V2 High 10
CVSS V3 Critical 9.8
Description
The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.
Overview
- CVE ID
- CVE-2017-7649
- Assigner
- emo@eclipse.org
- Vulnerability Status
- Analyzed
- Published Version
- 2017-09-11T16:29:00
- Last Modified Date
- 2017-09-29T15:04:41
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:* | 1 | OR | 2.0.2 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:C/I:C/A:C
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- COMPLETE
- Integrity Impact
- COMPLETE
- Availability Impact
- COMPLETE
- Base Score
- 10
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 10
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/eclipse/kura/issues/956 | Third Party Advisory |
| https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681 | Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2017-7649 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7649 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 08:18:29 | Added to TrackCVE | |||
| 2022-12-02 20:46:11 | security@eclipse.org | emo@eclipse.org | CVE Assigner | updated |
| 2022-12-02 20:46:11 | 2017-09-11T16:29Z | 2017-09-11T16:29:00 | CVE Published Date | updated |
| 2022-12-02 20:46:11 | 2017-09-29T15:04:41 | CVE Modified Date | updated | |
| 2022-12-02 20:46:11 | Analyzed | Vulnerability Status | updated |