CVE-2019-18241

Current Description

In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub.

Basic Data

Published	November 26, 2019
Last Modified	December 18, 2019
Assigner	cve@mitre.org
Data Type	CVE
Data Format	MITRE
Data Version	4.0
Problem Type	CWE-326
CVE Data Version	4.0

Base Metric V2

CVSS 2 - Version	2.0
CVSS 2 - Vector String	AV:A/AC:L/Au:N/C:P/I:N/A:N
CVSS 2 - Access Vector	ADJACENT_NETWORK
CVSS 2 - Access Complexity	LOW
CVSS 2 - Authentication	NONE
CVSS 2 - Confidentiality Impact	PARTIAL
CVSS 2 - Availability Impact	NONE
CVSS 2 - Base Score	3.3
Severity	LOW
Exploitability Score	6.5
Impact Score	2.9
Obtain All Privilege	false
Obtain User Privilege	false
Obtain Other Privilege	false

Base Metric V3

No data provided.

Configurations

AND

OR - Configuration 1

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	OS	Philips	Intellibridge Ec40 Firmware	*	*	*	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Hardware	Philips	Intellibridge Ec40	-	*	*	*	*	*	*	*

AND

OR - Configuration 2

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	OS	Philips	Intellibridge Ec80 Firmware	*	*	*	*	*	*	*	*

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Hardware	Philips	Intellibridge Ec80	-	*	*	*	*	*	*	*

Vulnerable Software List

Vendor	Product	Versions
Philips	Intellibridge Ec40 Firmware	*
Philips	Intellibridge Ec80 Firmware	*

References

Name	Source	URL	Tags
https://www.us-cert.gov/ics/advisories/icsma-19-318-01	https://www.us-cert.gov/ics/advisories/icsma-19-318-01	MISC	Third Party Advisory US Government Resource