Details of VAR-201810-1413

ID

VAR-201810-1413

CVE

CVE-2018-5399

TITLE

Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App

Trust: 0.8

sources: CERT/CC: VU#176301

DESCRIPTION

The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of root / amroot. The server is configured to use password only authentication not cryptographic keys, however the firmware image contains an RSA host-key for the server. An attacker can exploit this vulnerability to gain root access to the Angstrom Linux operating system and modify any binaries or configuration files in the firmware. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7. Auto-Maskin RP With remote panel DCU The control unit is a product that monitors and controls the ship's engine. These products have multiple vulnerabilities related to authentication and encryption that can be accessed by an attacker and take over the engine operation of the ship. Also, SSH The username and password for the connection are hard-coded and the password is easily guessable. Insufficient validation of connection source (CWE-346) - CVE-2018-5400 The product uses a proprietary protocol that is not documented to communicate with other equipment. Modbus We are communicating, but we have not verified the validity of the connection between devices. Sensitive information is sent in clear text (CWE-319) - CVE-2018-5401 The product is not encrypted Modbus Sending control information using communication. Sensitive information is sent in clear text (CWE-319) - CVE-2018-5402 The web server included in the product is an administrator using plain text that is not encrypted. PIN Sending code. These vulnerabilities Brian Satira Mr and Brian Olson Reported by him.An attacker could use this vulnerability to obtain information such as device configuration, configuration information, and sensor operating status. Also any Modbus ( control ) Information may also be sent. Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App are prone to the following security vulnerabilities: 1. An hard-coded credentials security bypass Vulnerability. 2. A security-bypass vulnerability. 3. Multiple information disclosure vulnerabilities. Attackers may exploit these issues to gain unauthorized access to the affected application, or to bypass certain security restrictions to perform unauthorized actions, and obtain sensitive information

Trust: 2.7

sources: NVD: CVE-2018-5399 // CERT/CC: VU#176301 // JVNDB: JVNDB-2018-008149 // BID: 105714 // VULMON: CVE-2018-5399

AFFECTED PRODUCTS

vendor:	auto maskin	model:	rp-210e	scope:	lt	version:	3.7	Trust: 1.0
vendor:	auto maskin	model:	dcu-210e	scope:	lt	version:	3.7	Trust: 1.0
vendor:	auto maskin as	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	auto maskin	model:	dcu 210e	scope:	-	version:	-	Trust: 0.8
vendor:	auto maskin	model:	marine pro observer	scope:	-	version:	-	Trust: 0.8
vendor:	auto maskin	model:	rp 210e	scope:	-	version:	-	Trust: 0.8
vendor:	auto maskin	model:	as marine pro observer	scope:	eq	version:	0	Trust: 0.3
vendor:	auto maskin	model:	as dcu 210e rp 210e	scope:	eq	version:	0	Trust: 0.3

sources: CERT/CC: VU#176301 // BID: 105714 // JVNDB: JVNDB-2018-008149 // NVD: CVE-2018-5399

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-5399
value:	CRITICAL
Trust: 1.0
cret@cert.org:	CVE-2018-5399
value:	CRITICAL
Trust: 1.0
CNNVD:	CNNVD-201810-259
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2018-5399
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-5399
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1

nvd@nist.gov:	CVE-2018-5399
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.0
cret@cert.org:	CVE-2018-5399
baseSeverity:	CRITICAL
baseScore:	9.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.5
version:	3.0
Trust: 1.0

sources: VULMON: CVE-2018-5399 // CNNVD: CNNVD-201810-259 // NVD: CVE-2018-5399 // NVD: CVE-2018-5399

PROBLEMTYPE DATA

problemtype:

CWE-798

Trust: 1.0

sources: NVD: CVE-2018-5399

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-259

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201810-259

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-008149

EXTERNAL IDS

db:	CERT/CC	id:	VU#176301	Trust: 3.6
db:	NVD	id:	CVE-2018-5399	Trust: 2.8
db:	ICS CERT	id:	ICSA-20-051-04	Trust: 1.7
db:	JVN	id:	JVNVU99039923	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-008149	Trust: 0.8
db:	AUSCERT	id:	ESB-2020.0648	Trust: 0.6
db:	CNNVD	id:	CNNVD-201810-259	Trust: 0.6
db:	BID	id:	105714	Trust: 0.3
db:	VULMON	id:	CVE-2018-5399	Trust: 0.1

sources: CERT/CC: VU#176301 // VULMON: CVE-2018-5399 // BID: 105714 // JVNDB: JVNDB-2018-008149 // CNNVD: CNNVD-201810-259 // NVD: CVE-2018-5399

REFERENCES

url:	https://www.kb.cert.org/vuls/id/176301	Trust: 2.8
url:	https://www.us-cert.gov/ics/advisories/icsa-20-051-04	Trust: 1.7
url:	about vulnerability notes	Trust: 0.8
url:	contact us about this vulnerability	Trust: 0.8
url:	provide a vendor statement	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5401	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5402	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5399	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5400	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu99039923/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-5399	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-5400	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-5401	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-5402	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.0648/	Trust: 0.6
url:	https://www.auto-maskin.com/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/798.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CERT/CC: VU#176301 // VULMON: CVE-2018-5399 // BID: 105714 // JVNDB: JVNDB-2018-008149 // CNNVD: CNNVD-201810-259 // NVD: CVE-2018-5399

CREDITS

Brian Satira and Brian Olson

Trust: 0.3

sources: BID: 105714

SOURCES

db:	CERT/CC	id:	VU#176301
db:	VULMON	id:	CVE-2018-5399
db:	BID	id:	105714
db:	JVNDB	id:	JVNDB-2018-008149
db:	CNNVD	id:	CNNVD-201810-259
db:	NVD	id:	CVE-2018-5399

LAST UPDATE DATE

2024-11-23T21:38:03.728000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#176301	date:	2018-10-16T00:00:00
db:	VULMON	id:	CVE-2018-5399	date:	2019-10-09T00:00:00
db:	BID	id:	105714	date:	2018-10-06T00:00:00
db:	JVNDB	id:	JVNDB-2018-008149	date:	2019-08-28T00:00:00
db:	CNNVD	id:	CNNVD-201810-259	date:	2020-02-25T00:00:00
db:	NVD	id:	CVE-2018-5399	date:	2024-11-21T04:08:44.443

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#176301	date:	2018-10-06T00:00:00
db:	VULMON	id:	CVE-2018-5399	date:	2018-10-08T00:00:00
db:	BID	id:	105714	date:	2018-10-06T00:00:00
db:	JVNDB	id:	JVNDB-2018-008149	date:	2018-10-10T00:00:00
db:	CNNVD	id:	CNNVD-201810-259	date:	2018-10-09T00:00:00
db:	NVD	id:	CVE-2018-5399	date:	2018-10-08T15:29:02.633