Missing encryption of sensitive data in Acoustic Technology products - CVE-2018-8864
Published: April 11, 2018
Vulnerability identifier: #VU11770
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8864
CWE-ID: CWE-311
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to bypass security restrictions on the target system.
The weakness exists due to missing encryption of sensitive data. An adjacent attacker can submit specially crafted malicious radio transmissions and trigger false alarms.
The weakness exists due to missing encryption of sensitive data. An adjacent attacker can submit specially crafted malicious radio transmissions and trigger false alarms.
Affected software
ALERT4000
MHPSS
HPSS32
HPSS16
MHPSS
HPSS32
HPSS16
How to mitigate CVE-2018-8864
Install update from vendor's website.