CVE-2018-5402 Weak cryptography in DCU-210E
An attacker on the network can intercept plaintext administrator PINs to gain access and upload malicious firmware or modify configurations on Auto-Maskin marine devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-5402?
CVE-2018-5402 is a critical vulnerability in Auto-Maskin DCU-210E, published on 8 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable code via file upload for firmware updates. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and the Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.
Which versions are affected by CVE-2018-5402?
It affects 3 products.
Products include Auto-Maskin Dcu 210e Firmware, Auto-Maskin Marine Pro Observer, Auto-Maskin Rp 210e Firmware.
How do I fix CVE-2018-5402?
No fix has been published for CVE-2018-5402 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-5402 being exploited?
There is no known exploitation of CVE-2018-5402 in the wild and no public exploit code.
Other vulnerabilities in Auto-Maskin DCU-210E
Sources
Also known as GHSA-g66x-xcf8-6hg7.