CVE-2018-6020 — MEDIUM (6.5)

Q: What is CVE-2018-6020?

CVE-2018-6020 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings.

Q: How severe is CVE-2018-6020?

CVE-2018-6020 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2018-6020?

Check the references section above for vendor advisories and patch information. Affected products include: Silextechnology Sd-320An Firmware, Silextechnology Sd-320An, Silextechnology Geh-Sd-320An Firmware, Silextechnology Geh-Sd-320An, Silextechnology Geh-500 Firmware.

Vulnerability Description

In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings.

CVSS Score

6.5

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Silextechnology	Sd-320An Firmware	<= 2.01
Silextechnology	Sd-320An	-
Silextechnology	Geh-Sd-320An Firmware	<= geh-1.1
Silextechnology	Geh-Sd-320An	-
Silextechnology	Geh-500 Firmware	<= 1.54
Silextechnology	Geh-500	-
Silextechnology	Sx-500 Firmware	-
Silextechnology	Sx-500	-

Related Weaknesses (CWE)

CWE-287

References

https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01Third Party AdvisoryUS Government Resource
https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01Third Party AdvisoryUS Government Resource

FAQ

What is CVE-2018-6020?

CVE-2018-6020 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings.

How severe is CVE-2018-6020?

CVE-2018-6020 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-6020?

Check the references section above for vendor advisories and patch information. Affected products include: Silextechnology Sd-320An Firmware, Silextechnology Sd-320An, Silextechnology Geh-Sd-320An Firmware, Silextechnology Geh-Sd-320An, Silextechnology Geh-500 Firmware.