Authentication bypass in F25 Series - CVE-2018-17935
Published: October 23, 2018 / Updated: October 24, 2018
Vulnerability identifier: #VU15511
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-17935
CWE-ID: CWE-294
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to bypass authentication on the target system.
The vulnerability exists due to use of fixed codes that are reproducible by sniffing and re-transmission. A remote unauthenticated attacker can bypass authentication to replay commands, spoof arbitrary message, or keep the controlled load in a permanent “stop” state.
Affected software
F25 Series
How to mitigate CVE-2018-17935
Update to version 00.0A.
F25 Series - update to 00.0A