High severity · published Dec 27, 2021
CVE-2021-33017
The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require…
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
Intellibridge Ec40 Firmware · Philips
through c.00.04 · source: NVD
IE
Intellibridge Ec80 Firmware · Philips
through c.00.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33017
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33017
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01
More from Intellibridge Ec40 Firmware
8.8
CVE-2021-32993
IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication,…
6.5
CVE-2019-18241
In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured…