CVE-2018-10627
Critical
Description
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. This vulnerability does not affect the i.LON 600 product.
SeverityCritical
CVSS9.8
Exploit probability—
ProductEchelon Smartserver 1 Firmware
PublishedJul 24, 2018
First seenJul 24, 2018
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- echelon smartserver_2_firmware4.11.007 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| echelon smartserver_1_firmware | No range specified | — |
| echelon smartserver_2_firmware | v < 4.11.007 | 4.11.007 |
| echelon i.lon_100_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.