CVE-2001-0395

Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2001-04/0170.html	Broken Link Exploit Vendor Advisory
http://www.securityfocus.com/bid/2578	Broken Link Patch Third Party Advisory VDB Entry Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:lightwavemo:consoleserver_3200_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:lightwavemo:consoleserver_3200:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2001-07-02 04:00

Updated : 2024-02-09 03:14

NVD link : CVE-2001-0395

Mitre link : CVE-2001-0395

CVE.ORG link : CVE-2001-0395

JSON object : View

Products Affected

lightwavemo

consoleserver_3200_firmware
consoleserver_3200

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2001-0395", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2001-07-02T04:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0170.html", "tags": ["Broken Link", "Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/2578", "tags": ["Broken Link", "Patch", "Third Party Advisory", "VDB Entry", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing."}], "lastModified": "2024-02-09T03:14:07.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lightwavemo:consoleserver_3200_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "154E7000-4A6E-422F-BD39-39CCD1528126"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lightwavemo:consoleserver_3200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D570E489-5590-4407-ADFF-58AA53C565AD"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}