#VU11770 Missing encryption of sensitive data in Acoustic Technology products - CVE-2018-8864

Vulnerability identifier: #VU11770

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2018-8864

CWE-ID: CWE-311

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerable software:
ALERT4000
MHPSS
HPSS32
HPSS16

Software vendor:
Acoustic Technology

The vulnerability allows an adjacent attacker to bypass security restrictions on the target system.

The weakness exists due to missing encryption of sensitive data. An adjacent attacker can submit specially crafted malicious radio transmissions and trigger false alarms.

Install update from vendor's website.

• https://ics-cert.us-cert.gov/advisories/ICSA-18-100-01