CVE-2008-5848

The Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for remote attackers to obtain access through an HTTP session, and (1) monitor or (2) control the module's Modbus/TCP I/O activity.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://ruxcon.org.au/files/2008/SIFT-Ruxcon2008-SCADA-Hacking-Modbus-Enabled-Devices.pdf	URL Repurposed
http://support.advantech.com.tw/support/DownloadSRDetail.aspx?SR_ID=1-95WMW
http://www.ruxcon.org.au/presentations.shtml#13	URL Repurposed

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:advantech:adam-6015::::::::
	cpe:2.3:h:advantech:adam-6017::::::::
	cpe:2.3:h:advantech:adam-6018::::::::
	cpe:2.3:h:advantech:adam-6022::::::::
	cpe:2.3:h:advantech:adam-6024::::::::
	cpe:2.3:h:advantech:adam-6050::::::::
	cpe:2.3:h:advantech:adam-6050w::::::::
	cpe:2.3:h:advantech:adam-6051::::::::
	cpe:2.3:h:advantech:adam-6051w::::::::
	cpe:2.3:h:advantech:adam-6052::::::::
	cpe:2.3:h:advantech:adam-6060::::::::
	cpe:2.3:h:advantech:adam-6060w::::::::
	cpe:2.3:h:advantech:adam-6066::::::::
	cpe:2.3:h:advantech:adam-6501::::::::

History

14 Feb 2024, 01:17

Type	Values Removed	Values Added
References	~~() http://ruxcon.org.au/files/2008/SIFT-Ruxcon2008-SCADA-Hacking-Modbus-Enabled-Devices.pdf -~~	() http://ruxcon.org.au/files/2008/SIFT-Ruxcon2008-SCADA-Hacking-Modbus-Enabled-Devices.pdf - URL Repurposed
References	~~() http://www.ruxcon.org.au/presentations.shtml#13 -~~	() http://www.ruxcon.org.au/presentations.shtml#13 - URL Repurposed

Information

Published : 2009-01-06 17:30

Updated : 2024-02-14 01:17

NVD link : CVE-2008-5848

Mitre link : CVE-2008-5848

CVE.ORG link : CVE-2008-5848

JSON object : View

Products Affected

advantech

adam-6022
adam-6015
adam-6051w
adam-6051
adam-6066
adam-6050w
adam-6017
adam-6018
adam-6060w
adam-6501
adam-6024
adam-6060
adam-6050
adam-6052

CWE

CWE-255

Credentials Management Errors

NVD-CWE-noinfo

{"id": "CVE-2008-5848", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-01-06T17:30:00.267", "references": [{"url": "http://ruxcon.org.au/files/2008/SIFT-Ruxcon2008-SCADA-Hacking-Modbus-Enabled-Devices.pdf", "tags": ["URL Repurposed"], "source": "cve@mitre.org"}, {"url": "http://support.advantech.com.tw/support/DownloadSRDetail.aspx?SR_ID=1-95WMW", "source": "cve@mitre.org"}, {"url": "http://www.ruxcon.org.au/presentations.shtml#13", "tags": ["URL Repurposed"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}, {"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for remote attackers to obtain access through an HTTP session, and (1) monitor or (2) control the module's Modbus/TCP I/O activity."}, {"lang": "es", "value": "El m\u00f3dulo Advantech ADAM-6000 tiene 00000000 como su contrase\u00f1a por defecto, lo que hace m\u00e1s f\u00e1cil a atacantes remotos obtener acceso a trav\u00e9s de una sesi\u00f3n HTTP, y (1) monitorizar o (2) controlar la actividad I/O del m\u00f3dulo Modbus/TCP."}], "lastModified": "2024-02-14T01:17:43.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:advantech:adam-6015:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA03C4FC-451D-4D80-91A9-94B62F11CF3E"}, {"criteria": "cpe:2.3:h:advantech:adam-6017:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23F14125-2C82-46B6-AA42-D17DAA9389F9"}, {"criteria": "cpe:2.3:h:advantech:adam-6018:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCA43127-85F4-46F4-A67F-54B66BFB0D51"}, {"criteria": "cpe:2.3:h:advantech:adam-6022:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35514F6C-F34A-420B-B08B-58388E4E772F"}, {"criteria": "cpe:2.3:h:advantech:adam-6024:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A84898FB-2906-4798-BF9D-EE4DADD6B7D7"}, {"criteria": "cpe:2.3:h:advantech:adam-6050:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51F66CE0-053B-4502-BE47-046F38D2E1EF"}, {"criteria": "cpe:2.3:h:advantech:adam-6050w:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "066BDEE7-CD3B-482F-82A6-063F48EAEC02"}, {"criteria": "cpe:2.3:h:advantech:adam-6051:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44CC898E-8BA4-401E-B95E-B22B4BD28658"}, {"criteria": "cpe:2.3:h:advantech:adam-6051w:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E89BA4B7-C9A2-46F4-8B12-B72CF8767890"}, {"criteria": "cpe:2.3:h:advantech:adam-6052:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F7CABA8-747E-454C-8100-39682281BD1A"}, {"criteria": "cpe:2.3:h:advantech:adam-6060:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C011882-D383-46CA-8E20-D008D039AB81"}, {"criteria": "cpe:2.3:h:advantech:adam-6060w:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C886F75-1B65-4695-9493-E3B1A647222A"}, {"criteria": "cpe:2.3:h:advantech:adam-6066:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDE2AE5D-58E7-43D7-8E70-86ACDAD9A3E2"}, {"criteria": "cpe:2.3:h:advantech:adam-6501:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "590DF4B1-9F0F-42A7-9579-602A27CB0B0F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}