What is the CVSS score of CVE-2017-14018?

CVE-2017-14018 has a CVSS 3.0 base score of 4.8 (Medium). CVSS vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.1%.

Endo Surgery Generator Gen11 Firmware CVE-2017-14018

MEDIUM

Improper Authentication (CWE-287)

2017-12-05 ics-cert@hq.dhs.gov

Authentication Bypass Endo Surgery Generator Gen11 Firmware

4.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

CVE Published

Dec 05, 2017 - 23:29 cve.org

MEDIUM 4.8

DescriptionCVE.org

An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The security authentication mechanism used between the Ethicon Endo-Surgery Generator Gen11 and single-patient use products can be bypassed, allowing for unauthorized devices to be connected to the generator, which could result in a loss of integrity or availability.

AnalysisAI

An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. Rated medium severity (CVSS 4.8), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The security authentication mechanism used between the Ethicon Endo-Surgery Generator Gen11 and single-patient use products can be bypassed, allowing for unauthorized devices to be connected to the generator, which could result in a loss of integrity or availability. Affected products include: Ethicon Endo-Surgery Generator Gen11 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.