Low severity · published May 25, 2018
CVE-2018-8862
In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially crafted malicious…
3.1
CVSS
0.6%
EPSS
No
On KEV
Description
In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms.
CVSS vector
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Alert4000 Firmware · Atisystem
All versions, or not specified · source: NVD
HF
Hpss16 Firmware · Atisystem
All versions, or not specified · source: NVD
HF
Hpss32 Firmware · Atisystem
All versions, or not specified · source: NVD
MF
Mhpss Firmware · Atisystem
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8862
Third Party Advisory
http://www.securityfocus.com/bid/103721
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-100-01
More from Alert4000 Firmware
3.1
CVE-2018-8864
In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vulnerability caused by specially crafted…