OpenCVE

Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Motorola	Sbg901 Sbg901 Firmware Sbg941 Sbg941 Firmware Svg1202 Svg1202 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:motorola:sbg901_firmware:sbg901-2.10.1.1-ga-00-581-nosh:*:*:*:*:*:*:*

cpe:2.3:h:motorola:sbg901:1.0:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:motorola:sbg941_firmware:sbg941-2.11.0.0-ga-07-624-nosh:*:*:*:*:*:*:*

cpe:2.3:h:motorola:sbg941:1.0:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:motorola:svg1202_firmware:svg1202-2.1.0.0-ga-14-ltsh:*:*:*:*:*:*:*

cpe:2.3:h:motorola:svg1202:1.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/106320
https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-12-23T21:00:00

Updated: 2024-08-05T11:58:19.138Z

Reserved: 2018-12-23T00:00:00

Link: CVE-2018-20399

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-12-23T21:29:01.467

Modified: 2024-11-21T04:01:24.613

Link: CVE-2018-20399

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-12-23T00:00:00", "descriptions": [{"lang": "en", "value": "Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-27T10:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv"}, {"tags": ["x_refsource_MISC"], "url": "https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html"}, {"name": "106320", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106320"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-20399", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv", "refsource": "MISC", "url": "https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv"}, {"name": "https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html", "refsource": "MISC", "url": "https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html"}, {"name": "106320", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106320"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T11:58:19.138Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html"}, {"name": "106320", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/106320"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-20399", "datePublished": "2018-12-23T21:00:00", "dateReserved": "2018-12-23T00:00:00", "dateUpdated": "2024-08-05T11:58:19.138Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:sbg901_firmware:sbg901-2.10.1.1-ga-00-581-nosh:*:*:*:*:*:*:*", "matchCriteriaId": "1477C9EB-C1FE-4ADA-BF73-6E9E5D791828", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:sbg901:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "8F1DBC20-177A-4EA2-BB7D-D0FDB8EE5EFB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:sbg941_firmware:sbg941-2.11.0.0-ga-07-624-nosh:*:*:*:*:*:*:*", "matchCriteriaId": "30033D48-E489-4FF3-A066-4BD6C6FED257", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:sbg941:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "9A0FE95D-024C-48DD-8477-86D316A0FDF8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:motorola:svg1202_firmware:svg1202-2.1.0.0-ga-14-ltsh:*:*:*:*:*:*:*", "matchCriteriaId": "EAB997D7-834C-4886-AE1C-936F7D8F064C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:motorola:svg1202:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "7522CEF9-38D6-4810-BE0F-F1F2CAD5EBF9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests."}, {"lang": "es", "value": "Los dispositivos Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH y SVG1202 SVG1202-2.1.0.0-GA-14-LTSH permiten que los atacantes remotos descubran credenciales mediante peticiones SNMP iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 e iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0."}], "id": "CVE-2018-20399", "lastModified": "2024-11-21T04:01:24.613", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-23T21:29:01.467", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106320"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106320"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}