cnvd - cnvd-2020-01009

CNVD-2020-01009

Vulnerability from cnvd - Published: 2020-01-08

Title

Philips IntelliBridge EC40 Hub和IntelliBridge EC80 Hub加密问题漏洞

Description

Philips IntelliBridge EC40 Hub和IntelliBridge EC80 Hub都是欧洲飞利浦（Philips）公司的一款监护仪模块。 Philips IntelliBridge EC40 Hub和IntelliBridge EC80 Hub存在弱加密漏洞，攻击者可利用该漏洞获得对EC40/80集线器的未经授权的访问。

Severity

低

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： http://www.philips.com

Reference

https://www.us-cert.gov/ics/advisories/icsma-19-318-01

Impacted products

Name
['Philips IntelliBridge EC40 Hub', 'Philips IntelliBridge EC80 Hub']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-18241"
    }
  },
  "description": "Philips IntelliBridge EC40 Hub\u548cIntelliBridge EC80 Hub\u90fd\u662f\u6b27\u6d32\u98de\u5229\u6d66\uff08Philips\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u76d1\u62a4\u4eea\u6a21\u5757\u3002\n\nPhilips IntelliBridge EC40 Hub\u548cIntelliBridge EC80 Hub\u5b58\u5728\u5f31\u52a0\u5bc6\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u5f97\u5bf9EC40/80\u96c6\u7ebf\u5668\u7684\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttp://www.philips.com",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-01009",
  "openTime": "2020-01-08",
  "products": {
    "product": [
      "Philips IntelliBridge EC40 Hub",
      "Philips IntelliBridge EC80 Hub"
    ]
  },
  "referenceLink": "https://www.us-cert.gov/ics/advisories/icsma-19-318-01",
  "serverity": "\u4f4e",
  "submitTime": "2019-11-15",
  "title": "Philips IntelliBridge EC40 Hub\u548cIntelliBridge EC80 Hub\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2019-18241 (GCVE-0-2019-18241)

Vulnerability from cvelistv5 – Published: 2019-11-25 23:25 – Updated: 2024-08-05 01:47

Summary

In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub.

Severity ?

No CVSS data available.

CWE

CWE-326 - INADEQUATE ENCRYPTION STRENGTH CWE-326

Assigner

icscert

References

URL

Tags

https://www.us-cert.gov/ics/advisories/icsma-19-318-01

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Philips IntelliBridge EC40 and EC80	Affected: IntelliBridge EC40 Hub, all versions, IntelliBridge EC80 Hub, all versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:47:14.050Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.us-cert.gov/ics/advisories/icsma-19-318-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Philips IntelliBridge EC40 and EC80",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "IntelliBridge EC40 Hub, all versions, IntelliBridge EC80 Hub, all versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-326",
              "description": "INADEQUATE ENCRYPTION STRENGTH CWE-326",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-25T23:25:05",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.us-cert.gov/ics/advisories/icsma-19-318-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2019-18241",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Philips IntelliBridge EC40 and EC80",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "IntelliBridge EC40 Hub, all versions, IntelliBridge EC80 Hub, all versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "INADEQUATE ENCRYPTION STRENGTH CWE-326"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsma-19-318-01",
              "refsource": "MISC",
              "url": "https://www.us-cert.gov/ics/advisories/icsma-19-318-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2019-18241",
    "datePublished": "2019-11-25T23:25:05",
    "dateReserved": "2019-10-22T00:00:00",
    "dateUpdated": "2024-08-05T01:47:14.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-01009

CVE-2019-18241 (GCVE-0-2019-18241)

Tags

Sightings

Nomenclature