CVE-2018-10627
Last modified
CVE-2018-10627 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. EPSS estimates a 1.23% chance of exploitation in the next 30 days.
Description
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. This vulnerability does not affect the i.LON 600 product.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Echelon | Smartserver 1 Firmware | All versions |
| Echelon | Smartserver 2 Firmware | < 4.11.007 |
| Echelon | I.Lon 100 Firmware | All versions |
References
- https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03Third Party Advisory, US Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-10627?
How severe is CVE-2018-10627?
How do I fix CVE-2018-10627?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-10620AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Mach…9.8
- CVE-2018-10621Delta Electronics Delta Industrial Automation DOPSoft versio…
- CVE-2018-10622Medtronic MyCareLink Patient Monitor uses per-product creden…5.2
- CVE-2018-10623Delta Electronics Delta Industrial Automation DOPSoft versio…
- CVE-2018-10624In Johnson Controls Metasys System Versions 8.0 and prior an…
- CVE-2018-10626Medtronic MyCareLink Patient Monitor’s update service does n…4.4
- CVE-2018-10628AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2…
- CVE-2018-1063Context relabeling of filesystems is vulnerable to symbolic …
- CVE-2018-10630For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3…
- CVE-2018-10631The 8840 Clinician Programmer executes the application progr…6.3
- CVE-2018-10632In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 170307…
- CVE-2018-10633Universal Robots Robot Controllers Version CB 3.1, SW Versio…
Are you affected by CVE-2018-10627?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST