Lucene search

CertccCVE-2016-9497

HistoryJul 13, 2018 - 8:29 p.m.

CVE-2016-9497

2018-07-1320:29:01

CWE-287

CWE-288

certcc

web.nvd.nist.gov

cve-2016-9497

hughes

modem

vulnerability

authentication bypass

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

58.6%

JSON

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel. By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem.

Affected configurations

Nvd

Node

hugheshn7740s_firmwareMatch6.9.0.34

AND

hugheshn7740sMatch-

Node

hughesdw7000_firmwareMatch6.9.0.34

AND

hughesdw7000Match-

Node

hugheshn7000s_firmwareMatch6.9.0.34

AND

hugheshn7000sMatch-

Node

hugheshn7000sm_firmwareMatch6.9.0.34

AND

hugheshn7000smMatch-

VendorProductVersionCPE
hugheshn7740s_firmware6.9.0.34cpe:2.3:o:hughes:hn7740s_firmware:6.9.0.34:*:*:*:*:*:*:*
hugheshn7740s-cpe:2.3:h:hughes:hn7740s:-:*:*:*:*:*:*:*
hughesdw7000_firmware6.9.0.34cpe:2.3:o:hughes:dw7000_firmware:6.9.0.34:*:*:*:*:*:*:*
hughesdw7000-cpe:2.3:h:hughes:dw7000:-:*:*:*:*:*:*:*
hugheshn7000s_firmware6.9.0.34cpe:2.3:o:hughes:hn7000s_firmware:6.9.0.34:*:*:*:*:*:*:*
hugheshn7000s-cpe:2.3:h:hughes:hn7000s:-:*:*:*:*:*:*:*
hugheshn7000sm_firmware6.9.0.34cpe:2.3:o:hughes:hn7000sm_firmware:6.9.0.34:*:*:*:*:*:*:*
hugheshn7000sm-cpe:2.3:h:hughes:hn7000sm:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hughes	hn7740s_firmware	6.9.0.34	cpe:2.3:o:hughes:hn7740s_firmware:6.9.0.34:::::::*
hughes	hn7740s	-	cpe:2.3:h:hughes:hn7740s:-:::::::*
hughes	dw7000_firmware	6.9.0.34	cpe:2.3:o:hughes:dw7000_firmware:6.9.0.34:::::::*
hughes	dw7000	-	cpe:2.3:h:hughes:dw7000:-:::::::*
hughes	hn7000s_firmware	6.9.0.34	cpe:2.3:o:hughes:hn7000s_firmware:6.9.0.34:::::::*
hughes	hn7000s	-	cpe:2.3:h:hughes:hn7000s:-:::::::*
hughes	hn7000sm_firmware	6.9.0.34	cpe:2.3:o:hughes:hn7000sm_firmware:6.9.0.34:::::::*
hughes	hn7000sm	-	cpe:2.3:h:hughes:hn7000sm:-:::::::*

CNA Affected

[
  {
    "product": "HN7740S",
    "vendor": "Hughes Satellite Modem",
    "versions": [
      {
        "status": "unknown",
        "version": "N/A"
      }
    ]
  },
  {
    "product": "DW7000",
    "vendor": "Hughes Satellite Modem",
    "versions": [
      {
        "status": "unknown",
        "version": "N/A"
      }
    ]
  },
  {
    "product": "HN7000S/SM",
    "vendor": "Hughes Satellite Modem",
    "versions": [
      {
        "status": "unknown",
        "version": "N/A"
      }
    ]
  }
]

References

www.kb.cert.org/vuls/id/614751

www.securityfocus.com/bid/96244

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

58.6%

JSON

Related for CVE-2016-9497