CVE-2015-8288

Опубликовано: 20 июн. 2016

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.

Комментарий

CWE-321: Use of Hard-coded Cryptographic Key

Ссылки

http://kb.netgear.com/app/answers/detail/a_id/30560
Vendor Advisory
http://www.kb.cert.org/vuls/id/778696
Third Party Advisory
US Government Resource
http://kb.netgear.com/app/answers/detail/a_id/30560
Vendor Advisory
http://www.kb.cert.org/vuls/id/778696
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:netgear:d3600_firmware:1.0.0.49:*:*:*:*:*:*:*

cpe:2.3:h:netgear:d3600:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:netgear:d6000_firmware:*:*:*:*:*:*:*:*

Версия до 1.0.0.49 (включая)

cpe:2.3:h:netgear:d6000:-:*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00586

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-549q-2p25-vrjq