CVE-2018-5399
published 2018-10-08CVE-2018-5399: The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The…
PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.10%
79.3th percentile
The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of root / amroot. The server is configured to use password only authentication not cryptographic keys, however the firmware image contains an RSA host-key for the server. An attacker can exploit this vulnerability to gain root access to the Angstrom Linux operating system and modify any binaries or configuration files in the firmware. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| auto-maskin | dcu-210e | >= 3.7 < 3.7 | 3.7 |
| auto-maskin | dcu-210e_firmware | < 3.7 | 3.7 |
| auto-maskin | rp-210e | >= 3.7 < 3.7 | 3.7 |
| auto-maskin | rp-210e_firmware | < 3.7 | 3.7 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App)
cisa_ics·2020-02-20·CVSS 9.1
[CRITICAL] Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App)
Last RevisedFebruary 20, 2020
Alert CodeICSA-20-051-04
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Auto-Maskin
- Equipment: RP 210E Remote Panels, DCU 210E Control Units, and Marine Observer Pro (Android App)
- Vulnerabilities: Cleartext Transmission of Sensitive Information, Origin Validation Error, Use of Hard-coded Credentials, Weak Password Recovery Mechanism for Forgotten Password, Weak Password Requirements
## 2. RISK EVALUATION
Successf
GHSA
GHSA-qxxm-7g2q-pwxw: The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015
ghsa_unreviewed·2022-05-13
CVE-2018-5399 [CRITICAL] CWE-798 GHSA-qxxm-7g2q-pwxw: The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015
The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of root / amroot. The server is configured to use password only authentication not cryptographic keys, however the firmware image contains an RSA host-key for the server. An attacker can exploit this vulnerability to gain root access to the Angstrom Linux operating system and modify any binaries or configuration files in the firmware. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.
No detection rules found.
No public exploits indexed.
2018-10-08
Published