by Kastro
Paper/Archive/CVE-2017-20234

CVE-2017-20234

Belden GarrettCom Magnum 6K and 10K Managed Switches — GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.5.395 × 207.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the authentication mechanism. Attackers can bypass login controls to access administrative functions and sensitive switch configuration without valid credentials.

Affected

ProductAffectedFixed inSource
GarrettCom Magnum 6K and 10K Managed Switches≤ 4.6.04.7.7CNA
GarrettCom Magnum 6K and 10K Managed Switches≤ 4.7.64.7.7CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryassets.belden.com/m/114be964b4651983/original/Security-Bulletin-MNS-6K-10K-GarrettCom-BSECV-2017-08.pdfwriteupvulncheck.com/advisories/garrettcom-magnum-6k-and-10k-authentication-bypass-via-hardcoded-string