Vulnerability Description
The Java client program for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 has a hardcoded AES encryption key, which makes it easier for man-in-the-middle attackers to (1) execute arbitrary Java code, or (2) gain access to machines connected to the switch, by hijacking a session.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Aten | Kh1516I Ip Kvm Switch | 1.0.063 |
| Aten | Kn9116 Ip Kvm Switch | 1.1.104 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/archive/1/503827/100/0/threaded
- http://www.securityfocus.com/bid/35108
- http://www.securityfocus.com/archive/1/503827/100/0/threaded
- http://www.securityfocus.com/bid/35108
FAQ
What is CVE-2009-1472?
CVE-2009-1472 is a vulnerability with a CVSS score of 10.0 (HIGH). The Java client program for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 has a hardcoded AES encryption key, which makes it easier for man-in...
How severe is CVE-2009-1472?
CVE-2009-1472 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-1472?
Check the references section above for vendor advisories and patch information. Affected products include: Aten Kh1516I Ip Kvm Switch, Aten Kn9116 Ip Kvm Switch.