CVE-2018-8855
Critical
Description
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP.
SeverityCritical
CVSS9.8
Exploit probability—
ProductEchelon Smartserver 1 Firmware
PublishedJul 24, 2018
First seenJul 24, 2018
Weakness typeCWE-319CWE-319
How to fix
Update
- echelon smartserver_2_firmware4.11.007 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| echelon smartserver_1_firmware | No range specified | — |
| echelon smartserver_2_firmware | v < 4.11.007 | 4.11.007 |
| echelon i.lon_100_firmware | No range specified | — |
| echelon i.lon_600_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.