Medium severity · published Mar 6, 2018
CVE-2018-5461
An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An inadequate encryption strength vulnerability in the web interface has been identified, which may allow an attacker to obtain sensitive information through a successful man-in-the-middle attack.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
Hirschmann M1-8mm-sc · Belden
All versions, or not specified · source: NVD
HM
Hirschmann M1-8sfp · Belden
All versions, or not specified · source: NVD
HM
Hirschmann M1-8sm-sc · Belden
All versions, or not specified · source: NVD
HM
Hirschmann M1-8tp-rj45 · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-24tp-f · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-24tp-fr · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp-f · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp-fr · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp-r · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach104-16tx-poep · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach104-16tx-poep +2x · Belden
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-5461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-5461
Third Party Advisory
http://www.securityfocus.com/bid/103340
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-065-01
More from Hirschmann M1-8mm-sc
9.8
CVE-2018-5469
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform…
8.8
CVE-2018-5465
A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches
6.5
CVE-2018-5467
An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform…
5.9
CVE-2018-5471
A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches