CVE-2018-8859
Critical
Description
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product.
SeverityCritical
CVSS9.8
Exploit probability—
ProductEchelon Smartserver 1 Firmware
PublishedJul 24, 2018
First seenJul 24, 2018
Weakness typeCWE-288CWE-288
How to fix
Update
- echelon smartserver_2_firmware4.11.007 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| echelon smartserver_1_firmware | No range specified | — |
| echelon smartserver_2_firmware | v < 4.11.007 | 4.11.007 |
| echelon i.lon_100_firmware | No range specified | — |
| echelon i.lon_600_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.