What is the CVSS score of CVE-2015-6418?

CVE-2015-6418 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.4%.

Sa520 CVE-2015-6418

MEDIUM

Information Exposure (CWE-200)

2015-12-13 psirt@cisco.com

Cisco Information Disclosure Microsoft Sa520 Sa520W Sa540 Rv016 Multi Wan Vpn Firmware Rv042 Dual Wan Vpn Router Firmware Rv042G Dual Gigabit Wan Vpn Firmware Rv082 Dual Wan Vpn Router Firmware

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 13, 2015 - 03:59 cve.org

MEDIUM 4.3

DescriptionCVE.org

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224.

AnalysisAI

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224. Affected products include: Cisco Sa520, Cisco Sa520W, Cisco Sa540, Cisco Rv016 Multi-Wan Vpn Firmware, Cisco Rv042 Dual Wan Vpn Router Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.