A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and manipulate traffic associated with product configuration. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101)
Una CWE-798: Se presenta un uso de credenciales embebidas que podría resultar en una divulgación de información. Si un atacante obtuviera la clave criptográfica SSH del dispositivo y tomara el control activo de la red operativa local conectada al producto, podría observar y manipular el tráfico asociado a la configuración del producto. Producto afectado: Easergy P5 (todas las versiones de firmware anteriores a V01.401.101)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:A/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | ADJACENT_NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-798
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | easergy_p5_firmware | * | <built-in method update of dict object at 0x7e60bae0c800> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:easergy_p5_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:easergy_p5:-:*:*:*:*:*:*:* |