What is the CVSS score of CVE-2018-17935?

CVE-2018-17935 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.7%.

F25 2S Firmware CVE-2018-17935

HIGH

Authentication Bypass by Capture-replay (CWE-294)

2018-10-24 ics-cert@hq.dhs.gov

RCE F25 2S Firmware F25 2D Firmware F25 4S Firmware F25 4D Firmware F25 6S Firmware F25 6D Firmware F25 8S Firmware F25 8D Firmware F25 10S Firmware F25 10D Firmware F25 60 Firmware

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 24, 2018 - 13:29 nvd

HIGH 8.1

DescriptionNVD

All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state.

AnalysisAI

All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-294. All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state. Affected products include: Telecrane F25-2S Firmware, Telecrane F25-2D Firmware, Telecrane F25-4S Firmware, Telecrane F25-4D Firmware, Telecrane F25-6S Firmware. Version information: before 00.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.