CVE-2021-32993 - Vulnerability Details - OpenCVE

IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00059.

Key SSVC decision points have not yet been added.

Vendors	Products
Philips	Intellibridge Ec40 Intellibridge Ec40 Firmware Intellibridge Ec80 Intellibridge Ec80 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:philips:intellibridge_ec40_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:philips:intellibridge_ec40:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:philips:intellibridge_ec80_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:philips:intellibridge_ec80:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-19714	IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2021-12-27T18:48:20.675533Z

Updated: 2024-09-17T03:52:56.730Z

Reserved: 2021-05-13T00:00:00

Link: CVE-2021-32993

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-12-27T19:15:08.163

Modified: 2024-11-21T06:08:05.087

Link: CVE-2021-32993

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "IntelliBridge EC 40 Hub", "vendor": "Philips", "versions": [{"lessThanOrEqual": "C.00.04", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "IntelliBridge EC 80 Hub", "vendor": "Philips", "versions": [{"lessThanOrEqual": "C.00.04", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks"}], "datePublic": "2021-11-18T00:00:00", "descriptions": [{"lang": "en", "value": "IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-27T18:48:20", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}], "source": {"advisory": "ICSMA-21-322-01", "discovery": "UNKNOWN"}, "title": "Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2021-11-18T15:34:00.000Z", "ID": "CVE-2021-32993", "STATE": "PUBLIC", "TITLE": "Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "IntelliBridge EC 40 Hub", "version": {"version_data": [{"version_affected": "<=", "version_value": "C.00.04"}]}}, {"product_name": "IntelliBridge EC 80 Hub", "version": {"version_data": [{"version_affected": "<=", "version_value": "C.00.04"}]}}]}, "vendor_name": "Philips"}]}}, "credit": [{"lang": "eng", "value": "Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-798 Use of Hard-coded Credentials"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}]}, "solution": [{"lang": "en"}], "source": {"advisory": "ICSMA-21-322-01", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:42:19.050Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-32993", "datePublished": "2021-12-27T18:48:20.675533Z", "dateReserved": "2021-05-13T00:00:00", "dateUpdated": "2024-09-17T03:52:56.730Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:philips:intellibridge_ec40_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F83F9AB8-C2A0-4C40-9034-56BDBB06FE56", "versionEndIncluding": "c.00.04", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:philips:intellibridge_ec40:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B1CA4D0-ADCF-4BBB-A1DB-F790B86AAB7C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:philips:intellibridge_ec80_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0023DEE-63FF-4921-B98D-94E0133A6F04", "versionEndIncluding": "c.00.04", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:philips:intellibridge_ec80:-:*:*:*:*:*:*:*", "matchCriteriaId": "B726E06E-D616-46A3-9496-DE42582C86C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."}, {"lang": "es", "value": "El IntelliBridge EC 40 y 60 Hub (versiones C.00.04 y anteriores) contiene credenciales embebidas para su propia autenticaci\u00f3n de entrada, la comunicaci\u00f3n de salida a componentes externos o el cifrado de datos internos"}], "id": "CVE-2021-32993", "lastModified": "2024-11-21T06:08:05.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-27T19:15:08.163", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}