CVE-2016-2333

{"id": "CVE-2016-2333", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2016-04-25T18:59:04.183", "references": [{"url": "http://www.kb.cert.org/vuls/id/822980", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' installations, which allows attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation."}, {"lang": "es", "value": "Dispositivos SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway con firmware en versiones anteriores a 01A.8 usan la misma clave de cifrado embebida en instalaciones de clientes diferentes, lo que permite a atacantes vencer mecanismos de protecci\u00f3n criptogr\u00e1ficos aprovechando el conocimiento de esta clave de otra instalaci\u00f3n."}], "lastModified": "2016-05-04T19:33:49.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:systech:syslink_sl-1000_modular_gateway:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "69F759E5-AC13-4B6A-8651-CCEF5849C59D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:systech:syslink_sl-1000_modular_gateway_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2BFB566-EDD8-4894-8A36-6D7A5FE61D39"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cret@cert.org"}