CVE-2021-32993 - OpenCVE

IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:A/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Philips	Intellibridge Ec40 Intellibridge Ec40 Firmware Intellibridge Ec80 Intellibridge Ec80 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:philips:intellibridge_ec40_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:philips:intellibridge_ec40:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:philips:intellibridge_ec80_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:philips:intellibridge_ec80:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2021-12-27T18:48:20.675533Z

Updated: 2024-09-17T03:52:56.730Z

Reserved: 2021-05-13T00:00:00

Link: CVE-2021-32993

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-12-27T19:15:08.163

Modified: 2022-01-10T15:42:24.197

Link: CVE-2021-32993

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "IntelliBridge EC 40 Hub", "vendor": "Philips", "versions": [{"lessThanOrEqual": "C.00.04", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "IntelliBridge EC 80 Hub", "vendor": "Philips", "versions": [{"lessThanOrEqual": "C.00.04", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks"}], "datePublic": "2021-11-18T00:00:00", "descriptions": [{"lang": "en", "value": "IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-27T18:48:20", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}], "source": {"advisory": "ICSMA-21-322-01", "discovery": "UNKNOWN"}, "title": "Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2021-11-18T15:34:00.000Z", "ID": "CVE-2021-32993", "STATE": "PUBLIC", "TITLE": "Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "IntelliBridge EC 40 Hub", "version": {"version_data": [{"version_affected": "<=", "version_value": "C.00.04"}]}}, {"product_name": "IntelliBridge EC 80 Hub", "version": {"version_data": [{"version_affected": "<=", "version_value": "C.00.04"}]}}]}, "vendor_name": "Philips"}]}}, "credit": [{"lang": "eng", "value": "Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-798 Use of Hard-coded Credentials"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}]}, "solution": [{"lang": "en"}], "source": {"advisory": "ICSMA-21-322-01", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:42:19.050Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-32993", "datePublished": "2021-12-27T18:48:20.675533Z", "dateReserved": "2021-05-13T00:00:00", "dateUpdated": "2024-09-17T03:52:56.730Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:philips:intellibridge_ec40_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F83F9AB8-C2A0-4C40-9034-56BDBB06FE56", "versionEndIncluding": "c.00.04", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:philips:intellibridge_ec40:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B1CA4D0-ADCF-4BBB-A1DB-F790B86AAB7C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:philips:intellibridge_ec80_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0023DEE-63FF-4921-B98D-94E0133A6F04", "versionEndIncluding": "c.00.04", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:philips:intellibridge_ec80:-:*:*:*:*:*:*:*", "matchCriteriaId": "B726E06E-D616-46A3-9496-DE42582C86C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."}, {"lang": "es", "value": "El IntelliBridge EC 40 y 60 Hub (versiones C.00.04 y anteriores) contiene credenciales embebidas para su propia autenticaci\u00f3n de entrada, la comunicaci\u00f3n de salida a componentes externos o el cifrado de datos internos"}], "id": "CVE-2021-32993", "lastModified": "2022-01-10T15:42:24.197", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2021-12-27T19:15:08.163", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}