Sign-up

ID

VAR-201306-0357


CVE

CVE-2013-4733


TITLE

Digital Alert Systems DASDEC and Monroe Electronics R189 One-Net firmware exposes private root SSH key

Trust: 0.8

sources: CERT/CC: VU#662676

DESCRIPTION

The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files. An attacker with SSH access to a device could use the key to log in with root privileges. Multiple Vendors EAS Devices are prone to an information-disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information that may lead to further attacks

Trust: 3.15

sources: NVD: CVE-2013-4733 // CERT/CC: VU#662676 // JVNDB: JVNDB-2013-003171 // CNVD: CNVD-2013-08662 // BID: 60911

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-08662

AFFECTED PRODUCTS

vendor:monroemodel:r189 one-net easscope:eqversion:2.0-0

Trust: 1.0

vendor:monroemodel:r189 one-net easscope:lteversion:2.0-1

Trust: 1.0

vendor:digital alertmodel:dasdec easscope:lteversion:2.0-1

Trust: 1.0

vendor:digital alertmodel:dasdec easscope:eqversion:2.0-0

Trust: 1.0

vendor:digital alertmodel: - scope: - version: -

Trust: 0.8

vendor:monroemodel: - scope: - version: -

Trust: 0.8

vendor:digital alertmodel:dasdecscope:ltversion:eas 2.0-2

Trust: 0.8

vendor:monroemodel:r189 one-netscope:ltversion:eas 2.0-2

Trust: 0.8

vendor:monroemodel:electronics one-net e189 emergency alert system devicesscope: - version: -

Trust: 0.6

vendor:digitalmodel:alert systems dasdecscope: - version: -

Trust: 0.6

vendor:monroemodel:electronics r189se one-netsescope:eqversion:0

Trust: 0.3

vendor:monroemodel:electronics r189 one-netscope:eqversion:0

Trust: 0.3

vendor:digitalmodel:alert systems dasdec-iiscope:eqversion:0

Trust: 0.3

vendor:digitalmodel:alert systems dasdec-iscope:eqversion:0

Trust: 0.3

vendor:monroemodel:electronics r189se one-netsescope:neversion:2.0-2

Trust: 0.3

vendor:monroemodel:electronics r189 one-netscope:neversion:2.0-2

Trust: 0.3

vendor:digitalmodel:alert systems dasdec-iiscope:neversion:2.0-2

Trust: 0.3

vendor:digitalmodel:alert systems dasdec-iscope:neversion:2.0-2

Trust: 0.3

sources: CERT/CC: VU#662676 // CNVD: CNVD-2013-08662 // BID: 60911 // JVNDB: JVNDB-2013-003171 // NVD: CVE-2013-4733

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-4733
value: HIGH

Trust: 1.0

NVD: CVE-2013-0137
value: HIGH

Trust: 0.8

NVD: CVE-2013-4733
value: HIGH

Trust: 0.8

CNVD: CNVD-2013-08662
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201306-518
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2013-4733
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2013-0137
severity: HIGH
baseScore: 10.0
vectorString: NONE
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2013-08662
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:N/C:C/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CERT/CC: VU#662676 // CNVD: CNVD-2013-08662 // JVNDB: JVNDB-2013-003171 // CNNVD: CNNVD-201306-518 // NVD: CVE-2013-4733

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.8

sources: JVNDB: JVNDB-2013-003171 // NVD: CVE-2013-4733

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201306-518

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201306-518

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-003171

PATCH
title:Monroe Electronics Provides New Software Update Enhancing Security and Functionalityurl:http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf
Trust: 0.8
title:Monroe Electronics Provides New Software Update Enhancing Security and Functionalityurl:http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf
Trust: 0.8
title:TA13-175Aurl:http://software.fujitsu.com/jp/security/vulnerabilities/ta13-175a.html
Trust: 0.8
title:Multiple vendors' EAS device WEB server sensitive information disclosure vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/34920
Trust: 0.6
title:Digital Alert Systems DASDEC EAS Fixes for permission permissions and access control vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=170988
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-08662 // 
            
            
            
            JVNDB: JVNDB-2013-003171 // 
            
            
            
            CNNVD: CNNVD-201306-518

EXTERNAL IDS
db:CERT/CCid:VU#662676
Trust: 4.1
db:NVDid:CVE-2013-4733
Trust: 3.3
db:USCERTid:TA13-175A
Trust: 1.6
db:JVNid:JVNVU99235742
Trust: 0.8
db:JVNDBid:JVNDB-2013-003171
Trust: 0.8
db:CNVDid:CNVD-2013-08662
Trust: 0.6
db:CNNVDid:CNNVD-201306-518
Trust: 0.6
db:BIDid:60911
Trust: 0.3
sources:
            
            
            CERT/CC: VU#662676 // 
            
            
            
            CNVD: CNVD-2013-08662 // 
            
            
            
            BID: 60911 // 
            
            
            
            JVNDB: JVNDB-2013-003171 // 
            
            
            
            CNNVD: CNNVD-201306-518 // 
            
            
            
            NVD: CVE-2013-4733

REFERENCES
url:http://www.kb.cert.org/vuls/id/662676
Trust: 3.3
url:http://www.kb.cert.org/vuls/id/aamn-98muk2
Trust: 2.7
url:http://www.kb.cert.org/vuls/id/aamn-98mu7h
Trust: 2.7
url:http://www.monroe-electronics.com/monroe_electronics_pdf/130604-monroe-security-pr.pdf
Trust: 2.4
url:http://www.digitalalertsystems.com/pdf/130604-monroe-security-pr.pdf
Trust: 2.4
url:http://www.us-cert.gov/ncas/alerts/ta13-175a
Trust: 1.6
url:http://www.monroe-electronics.com/eas_pages/r189se_registration.html
Trust: 1.6
url:http://www.monroe-electronics.com/eas_pages/prod_r189se.html
Trust: 0.8
url:http://www.digitalalertsystems.com/products_enc-dec.html
Trust: 0.8
url:http://www.digitalalertsystems.com/pdf/wpdas-122.pdf
Trust: 0.8
url:http://www.fcc.gov/guides/emergency-alert-system-eas
Trust: 0.8
url:http://www.ioactive.com/news-events/ioactive_uncovers_vulnerabilities_in_united_states_emergency_alerting_system.html
Trust: 0.8
url:http://www.ioactive.com/pdfs/ioactive_dasdec_vulnerabilities.pdf
Trust: 0.8
url:http://blog.ioactive.com/2013/10/strike-two-for-emergency-alerting.html
Trust: 0.8
url:http://blog.ioactive.com/2013/07/why-vendor-openness-still-matters.html
Trust: 0.8
url:http://www.commlawblog.com/2013/02/articles/broadcast/fcc-urges-broadcasters-to-secure-eas-equipment/
Trust: 0.8
url:http://www.broadcastlawblog.com/2013/02/articles/emergency-communications/hackers-use-eas-to-send-alert-of-zombie-attack-fcc-issues-urgent-warning-to-broadcasters-to-secure-their-eas-systems/
Trust: 0.8
url:http://www.radioworld.com/article/eas-hack-cap-not-the-issue-internet-security-is/217746
Trust: 0.8
url:http://www.radioworld.com/article/stations-urged-to-protect-their-eas/217746
Trust: 0.8
url:http://transition.fcc.gov/pshs/techtopics/techtopics21.html
Trust: 0.8
url:http://www.thebdr.net/articles/fcc/eas/eas.html
Trust: 0.8
url:http://www.thebdr.net/articles/fcc/eas/eas-q5.pdf
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/798.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/532.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/341.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/320.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/321.html
Trust: 0.8
url:http://www.cert.org/downloads/vuls/662676/ssh-key-test.sh
Trust: 0.8
url:https://raw.github.com/aspiers/ssh-config/master/bin/ssh-list-pubkeys
Trust: 0.8
url:http://www.wired.com/threatlevel/2013/07/eas-holes/
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4733
Trust: 0.8
url:http://jvn.jp/cert/jvnvu99235742
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4733
Trust: 0.8
url:http://www.digitalalertsystems.com/
Trust: 0.3
url:http://www.monroe-electronics.com/
Trust: 0.3
sources:
            
            
            CERT/CC: VU#662676 // 
            
            
            
            CNVD: CNVD-2013-08662 // 
            
            
            
            BID: 60911 // 
            
            
            
            JVNDB: JVNDB-2013-003171 // 
            
            
            
            CNNVD: CNNVD-201306-518 // 
            
            
            
            NVD: CVE-2013-4733

CREDITS
Mike Davis and Cesar Cerrudo of IOActive
Trust: 0.3
sources:
            
            
            BID: 60911

SOURCES
db:CERT/CCid:VU#662676
db:CNVDid:CNVD-2013-08662
db:BIDid:60911
db:JVNDBid:JVNDB-2013-003171
db:CNNVDid:CNNVD-201306-518
db:NVDid:CVE-2013-4733

LAST UPDATE DATE
2025-04-11T22:59:07.128000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#662676date:2014-05-07T00:00:00
db:CNVDid:CNVD-2013-08662date:2013-08-28T00:00:00
db:BIDid:60911date:2013-06-26T00:00:00
db:JVNDBid:JVNDB-2013-003171date:2013-07-02T00:00:00
db:CNNVDid:CNNVD-201306-518date:2021-11-24T00:00:00
db:NVDid:CVE-2013-4733date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CERT/CCid:VU#662676date:2013-06-26T00:00:00
db:CNVDid:CNVD-2013-08662date:2013-07-03T00:00:00
db:BIDid:60911date:2013-06-26T00:00:00
db:JVNDBid:JVNDB-2013-003171date:2013-07-02T00:00:00
db:CNNVDid:CNNVD-201306-518date:2013-06-30T00:00:00
db:NVDid:CVE-2013-4733date:2013-06-30T19:28:10.550