Sign-up

ID

VAR-201707-0760


CVE

CVE-2017-11743


TITLE

MEDHOST Connex Vulnerabilities related to the use of hard-coded credentials

Trust: 0.8

sources: JVNDB: JVNDB-2017-006916

DESCRIPTION

MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of the hard-coded credential and the ability to communicate directly with the Mirth Connect management console may be able to intercept sensitive patient information. The admin account password is hard-coded as $K8t1ng throughout the application, and is the same across all installations. Customers do not have the option to change the Mirth Connect admin account password. The Mirth Connect admin account is created during the Connex install. The plaintext account password is hard-coded multiple times in the Connex install and update scripts. MEDHOST Connex Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MEDHOSTConnex is a medical device from MEDHOST in the United States. There is a security hole in MEDHOSTConnex. A remote attacker can exploit this vulnerability to obtain sensitive information. MEDHOST Connex is prone to a security-bypass vulnerability An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions

Trust: 2.43

sources: NVD: CVE-2017-11743 // JVNDB: JVNDB-2017-006916 // CNVD: CNVD-2018-09380 // BID: 100086

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-09380

AFFECTED PRODUCTS

vendor:medhostmodel:connexscope:eqversion: -

Trust: 1.6

vendor:medhostmodel:connexscope: - version: -

Trust: 1.4

vendor:medhostmodel:connexscope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2018-09380 // BID: 100086 // JVNDB: JVNDB-2017-006916 // CNNVD: CNNVD-201707-1478 // NVD: CVE-2017-11743

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-11743
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-11743
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-09380
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201707-1478
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2017-11743
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-09380
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2017-11743
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-09380 // JVNDB: JVNDB-2017-006916 // CNNVD: CNNVD-201707-1478 // NVD: CVE-2017-11743

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.8

sources: JVNDB: JVNDB-2017-006916 // NVD: CVE-2017-11743

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-1478

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201707-1478

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-006916

PATCH
title:Top Pageurl:http://www.medhost.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-006916

EXTERNAL IDS
db:NVDid:CVE-2017-11743
Trust: 3.3
db:BIDid:100086
Trust: 1.9
db:JVNDBid:JVNDB-2017-006916
Trust: 0.8
db:CNVDid:CNVD-2018-09380
Trust: 0.6
db:CNNVDid:CNNVD-201707-1478
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-09380 // 
            
            
            
            BID: 100086 // 
            
            
            
            JVNDB: JVNDB-2017-006916 // 
            
            
            
            CNNVD: CNNVD-201707-1478 // 
            
            
            
            NVD: CVE-2017-11743

REFERENCES
url:http://seclists.org/fulldisclosure/2017/jul/75
Trust: 2.7
url:http://www.securityfocus.com/bid/100086
Trust: 1.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11743
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-11743
Trust: 0.8
url:http://www.medhost.com
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-09380 // 
            
            
            
            BID: 100086 // 
            
            
            
            JVNDB: JVNDB-2017-006916 // 
            
            
            
            CNNVD: CNNVD-201707-1478 // 
            
            
            
            NVD: CVE-2017-11743

CREDITS
Allen Franks
Trust: 0.3
sources:
            
            
            BID: 100086

SOURCES
db:CNVDid:CNVD-2018-09380
db:BIDid:100086
db:JVNDBid:JVNDB-2017-006916
db:CNNVDid:CNNVD-201707-1478
db:NVDid:CVE-2017-11743

LAST UPDATE DATE
2025-04-20T23:26:03.151000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-09380date:2018-05-14T00:00:00
db:BIDid:100086date:2017-07-30T00:00:00
db:JVNDBid:JVNDB-2017-006916date:2017-09-06T00:00:00
db:CNNVDid:CNNVD-201707-1478date:2017-11-29T00:00:00
db:NVDid:CVE-2017-11743date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-09380date:2018-05-14T00:00:00
db:BIDid:100086date:2017-07-30T00:00:00
db:JVNDBid:JVNDB-2017-006916date:2017-09-06T00:00:00
db:CNNVDid:CNNVD-201707-1478date:2017-07-31T00:00:00
db:NVDid:CVE-2017-11743date:2017-07-31T13:29:01.627