Strix
26.1K

CVE-2019-18241

MEDIUMCVSS 6.5/10EPSS 0.33%

Last modified

CVE-2019-18241 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub.. EPSS estimates a 0.33% chance of exploitation in the next 30 days.

Description

In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
0.33%

24.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
PhilipsIntellibridge Ec40 FirmwareAll versions
PhilipsIntellibridge Ec80 FirmwareAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-18241?
In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub.
How severe is CVE-2019-18241?
CVE-2019-18241 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.33% probability of exploitation in the next 30 days.
How do I fix CVE-2019-18241?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-18241?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST