Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-5465

A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fixation vulnerability in the web interface has been identified, which may allow an attacker to hijack web sessions.

Published

2018-03-06T21:29:00.300

Last Modified

2024-11-21T04:08:51.183

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-384
Type: Primary
CWE-384

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Hardware	belden	hirschmann_rs20-0900mmm2tdau	-	Yes
Hardware	belden	hirschmann_rs20-0900nnm4tdau	-	Yes
Hardware	belden	hirschmann_rs20-0900vvm2tdau	-	Yes
Hardware	belden	hirschmann_rs20-1600l2l2sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600l2m2sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600l2s2sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600l2t1sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600m2m2sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600m2t1sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600s2m2sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600s2s2sdau	-	Yes
Hardware	belden	hirschmann_rs20-1600s2t1sdau	-	Yes
Hardware	belden	hirschmann_rsr20	-	Yes
Hardware	belden	hirschmann_rsr30	-	Yes
Hardware	belden	hirschmann_rsb20-0800m2m2saab	-	Yes
Hardware	belden	hirschmann_rsb20-0800m2m2saabe	-	Yes
Hardware	belden	hirschmann_rsb20-0800m2m2taab	-	Yes
Hardware	belden	hirschmann_rsb20-0800m2m2taabe	-	Yes
Hardware	belden	hirschmann_rsb20-0800s2s2saab	-	Yes
Hardware	belden	hirschmann_rsb20-0800s2s2saabe	-	Yes
Hardware	belden	hirschmann_rsb20-0800s2s2taab	-	Yes
Hardware	belden	hirschmann_rsb20-0800s2s2taabe	-	Yes
Hardware	belden	hirschmann_rsb20-0800t1t1saab	-	Yes
Hardware	belden	hirschmann_rsb20-0800t1t1saabe	-	Yes
Hardware	belden	hirschmann_rsb20-0800t1t1taab	-	Yes
Hardware	belden	hirschmann_rsb20-0800t1t1taabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900m2ttsaab	-	Yes
Hardware	belden	hirschmann_rsb20-0900m2ttsaabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900m2tttaab	-	Yes
Hardware	belden	hirschmann_rsb20-0900m2tttaabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900mmm2saab	-	Yes
Hardware	belden	hirschmann_rsb20-0900mmm2saabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900mmm2taab	-	Yes
Hardware	belden	hirschmann_rsb20-0900mmm2taabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900s2ttsaab	-	Yes
Hardware	belden	hirschmann_rsb20-0900s2ttsaabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900s2tttaab	-	Yes
Hardware	belden	hirschmann_rsb20-0900s2tttaabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900vvm2saab	-	Yes
Hardware	belden	hirschmann_rsb20-0900vvm2saabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900vvm2taab	-	Yes
Hardware	belden	hirschmann_rsb20-0900vvm2taabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900zzz6saab	-	Yes
Hardware	belden	hirschmann_rsb20-0900zzz6saabe	-	Yes
Hardware	belden	hirschmann_rsb20-0900zzz6taab	-	Yes
Hardware	belden	hirschmann_rsb20-0900zzz6taabe	-	Yes
Hardware	belden	hirschmann_m1-8mm-sc	-	Yes
Hardware	belden	hirschmann_m1-8sfp	-	Yes
Hardware	belden	hirschmann_m1-8sm-sc	-	Yes
Hardware	belden	hirschmann_m1-8tp-rj45	-	Yes
Hardware	belden	hirschmann_mach102-24tp-f	-	Yes
Hardware	belden	hirschmann_mach102-24tp-fr	-	Yes
Hardware	belden	hirschmann_mach102-8tp	-	Yes
Hardware	belden	hirschmann_mach102-8tp-f	-	Yes
Hardware	belden	hirschmann_mach102-8tp-fr	-	Yes
Hardware	belden	hirschmann_mach102-8tp-r	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep-l3p	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_\+2x	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_\+2x-l3p	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_\+2x_-e	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_\+2x_-e-l3p	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_\+2x_-r	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_\+2x_-r-l3p	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_-e	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_-e-l3p	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_-r	-	Yes
Hardware	belden	hirschmann_mach104-16tx-poep_-r-l3p	-	Yes
Hardware	belden	hirschmann_mach104-20tx-f	-	Yes
Hardware	belden	hirschmann_mach104-20tx-f-4poe	-	Yes
Hardware	belden	hirschmann_mach104-20tx-f-l3p	-	Yes
Hardware	belden	hirschmann_mach104-20tx-fr	-	Yes
Hardware	belden	hirschmann_mach104-20tx-fr-l3p	-	Yes
Hardware	belden	hirschmann_mach4002-24g\+3x-l2p	-	Yes
Hardware	belden	hirschmann_mach4002-24g\+3x-l3e	-	Yes
Hardware	belden	hirschmann_mach4002-24g\+3x-l3p	-	Yes
Hardware	belden	hirschmann_mach4002-24g-l2p	-	Yes
Hardware	belden	hirschmann_mach4002-24g-l3e	-	Yes
Hardware	belden	hirschmann_mach4002-24g-l3p	-	Yes
Hardware	belden	hirschmann_mach4002-48g\+3x-l2p	-	Yes
Hardware	belden	hirschmann_mach4002-48g\+3x-l3e	-	Yes
Hardware	belden	hirschmann_mach4002-48g\+3x-l3p	-	Yes
Hardware	belden	hirschmann_mach4002-48g-l2p	-	Yes
Hardware	belden	hirschmann_mach4002-48g-l3e	-	Yes
Hardware	belden	hirschmann_mach4002-48g-l3p	-	Yes
Hardware	belden	hirschmann_ms20-0800eccp	-	Yes
Hardware	belden	hirschmann_ms20-0800saae	-	Yes
Hardware	belden	hirschmann_ms20-0800saap	-	Yes
Hardware	belden	hirschmann_ms20-1600eccp	-	Yes
Hardware	belden	hirschmann_ms20-1600saae	-	Yes
Hardware	belden	hirschmann_ms20-1600saap	-	Yes
Hardware	belden	hirschmann_ms30-0802saae	-	Yes
Hardware	belden	hirschmann_ms30-0802saap	-	Yes
Hardware	belden	hirschmann_ms30-1602saae	-	Yes
Hardware	belden	hirschmann_octopus_16m	-	Yes
Hardware	belden	hirschmann_octopus_16m-8poe	-	Yes
Hardware	belden	hirschmann_octopus_16m-train	-	Yes
Hardware	belden	hirschmann_octopus_16m-train-bp	-	Yes
Hardware	belden	hirschmann_octopus_24m	-	Yes
Hardware	belden	hirschmann_octopus_24m-8_poe	-	Yes
Hardware	belden	hirschmann_octopus_24m-train	-	Yes
Hardware	belden	hirschmann_octopus_24m-train-bp	-	Yes
Hardware	belden	hirschmann_octopus_5tx_eec	-	Yes
Hardware	belden	hirschmann_octopus_8m	-	Yes
Hardware	belden	hirschmann_octopus_8m-6poe	-	Yes
Hardware	belden	hirschmann_octopus_8m-8poe	-	Yes
Hardware	belden	hirschmann_octopus_8m-train	-	Yes
Hardware	belden	hirschmann_octopus_8m-train-bp	-	Yes
Hardware	belden	hirschmann_octopus_8tx-eec	-	Yes
Hardware	belden	hirschmann_octopus_8tx_poe-eec	-	Yes
Hardware	belden	hirschmann_octopus_os20-000900t5t5tafbhh	-	Yes
Hardware	belden	hirschmann_octopus_os20-000900t5t5tnebhh	-	Yes
Hardware	belden	hirschmann_octopus_os20-0010001m1mtrephh	-	Yes
Hardware	belden	hirschmann_octopus_os20-0010001s1strephh	-	Yes
Hardware	belden	hirschmann_octopus_os20-0010004m4mtrephh	-	Yes
Hardware	belden	hirschmann_octopus_os20-0010004s4strephh	-	Yes
Hardware	belden	hirschmann_octopus_os20-001000t5t5tafuhb	-	Yes
Hardware	belden	hirschmann_octopus_os20-001000t5t5tneuhb	-	Yes
Hardware	belden	hirschmann_octopus_os24-080900t5t5tffbhh	-	Yes
Hardware	belden	hirschmann_octopus_os24-080900t5t5tnebhh	-	Yes
Hardware	belden	hirschmann_octopus_os24-081000t5t5tffuhb	-	Yes
Hardware	belden	hirschmann_octopus_os24-081000t5t5tneuhb	-	Yes
Hardware	belden	hirschmann_octopus_os30	-	Yes
Hardware	belden	hirschmann_octopus_os30-0008021a1atrephh	-	Yes
Hardware	belden	hirschmann_octopus_os30-0008021b1btrephh	-	Yes
Hardware	belden	hirschmann_octopus_os30-0008024a4atrephh	-	Yes
Hardware	belden	hirschmann_octopus_os30-0008024b4btrephh	-	Yes
Hardware	belden	hirschmann_octopus_os32-080802o6o6tpephh	-	Yes
Hardware	belden	hirschmann_octopus_os32-080802t6t6tpephh	-	Yes
Hardware	belden	hirschmann_octopus_os32-081602o6o6tpephh	-	Yes
Hardware	belden	hirschmann_octopus_os32-081602t6t6tpephh	-	Yes
Hardware	belden	hirschmann_octopus_os34	-	Yes
Hardware	belden	hirschmann_octopus_os3x-xx16xxx	-	Yes
Hardware	belden	hirschmann_octopus_os3x-xx24xxx	-	Yes

References

http://www.securityfocus.com/bid/103340 Third Party Advisory, VDB Entry ([email protected])
https://ics-cert.us-cert.gov/advisories/ICSA-18-065-01 Mitigation, Third Party Advisory, US Government Resource ([email protected])
http://www.securityfocus.com/bid/103340 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://ics-cert.us-cert.gov/advisories/ICSA-18-065-01 Mitigation, Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)