Critical severity · published Mar 6, 2018
CVE-2018-5469
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform…
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An improper restriction of excessive authentication vulnerability in the web interface has been identified, which may allow an attacker to brute force authentication.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
Hirschmann M1-8mm-sc · Belden
All versions, or not specified · source: NVD
HM
Hirschmann M1-8sfp · Belden
All versions, or not specified · source: NVD
HM
Hirschmann M1-8sm-sc · Belden
All versions, or not specified · source: NVD
HM
Hirschmann M1-8tp-rj45 · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-24tp-f · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-24tp-fr · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp-f · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp-fr · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach102-8tp-r · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach104-16tx-poep · Belden
All versions, or not specified · source: NVD
HM
Hirschmann Mach104-16tx-poep +2x · Belden
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-5469
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-5469
Third Party Advisory
http://www.securityfocus.com/bid/103340
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-065-01
More from Hirschmann M1-8mm-sc
8.8
CVE-2018-5465
A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches
6.5
CVE-2018-5467
An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform…
6.5
CVE-2018-5461
An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches
5.9
CVE-2018-5471
A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches