CVE-2001-1425

The challenge-response authentication of the EXPERT user for Alcatel Speed Touch running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 allows remote attackers to gain privileges by directly computing the response based on information that is provided by the device during login.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://security.sdsc.edu/self-help/alcatel/alcatel-bugs.html
http://www.cert.org/advisories/CA-2001-08.html	US Government Resource
http://www.kb.cert.org/vuls/id/243592	US Government Resource
http://www.securityfocus.com/archive/1/175229
http://www.securityfocus.com/bid/2568	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6354

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:alcatel:speed_touch_home:khdsaa.108:::::::*
	cpe:2.3:h:alcatel:speed_touch_home:khdsaa.132:::::::*
	cpe:2.3:h:alcatel:speed_touch_home:khdsaa.133:::::::*
	cpe:2.3:h:alcatel:speed_touch_home:khdsaa.134:::::::*

History

No history.

Information

Published : 2001-04-10 04:00

Updated : 2017-07-11 01:29

NVD link : CVE-2001-1425

Mitre link : CVE-2001-1425

CVE.ORG link : CVE-2001-1425

JSON object : View

Products Affected

alcatel

speed_touch_home

CWE

NVD-CWE-Other

{"id": "CVE-2001-1425", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2001-04-10T04:00:00.000", "references": [{"url": "http://security.sdsc.edu/self-help/alcatel/alcatel-bugs.html", "source": "cve@mitre.org"}, {"url": "http://www.cert.org/advisories/CA-2001-08.html", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/243592", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/175229", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/2568", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6354", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The challenge-response authentication of the EXPERT user for Alcatel Speed Touch running firmware KHDSAA.108 and KHDSAA.132 through KHDSAA.134 allows remote attackers to gain privileges by directly computing the response based on information that is provided by the device during login."}], "lastModified": "2017-07-11T01:29:06.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:alcatel:speed_touch_home:khdsaa.108:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91040F84-5FFF-455F-B81A-EE2F450E878B"}, {"criteria": "cpe:2.3:h:alcatel:speed_touch_home:khdsaa.132:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5983F496-F470-4347-95DA-CF59EB3956E3"}, {"criteria": "cpe:2.3:h:alcatel:speed_touch_home:khdsaa.133:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13D1F571-1947-4FDB-AE33-D1FD86E9116B"}, {"criteria": "cpe:2.3:h:alcatel:speed_touch_home:khdsaa.134:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10C8A4DE-F452-4063-A82E-0033190C490A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}