CVE-2018-8862 Auth bypass in Emergency Mass Notification Systems
Attackers can remotely trigger false alarms in ATI Systems notification devices via malicious radio transmissions due to improper authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-8862?
CVE-2018-8862 is a low-severity authentication bypass vulnerability in Acoustic Technology, Inc. (ATI Systems) Emergency Mass Notification Systems, published on 25 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms.
Weakness: CWE-287
Which versions are affected by CVE-2018-8862?
It affects 4 products.
Products include Atisystem Alert4000 Firmware, Atisystem Hpss16 Firmware, Atisystem Hpss32 Firmware, Atisystem Mhpss Firmware.
How do I fix CVE-2018-8862?
No fix has been published for CVE-2018-8862 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-8862 being exploited?
There is no known exploitation of CVE-2018-8862 in the wild and no public exploit code.
Other vulnerabilities in Acoustic Technology, Inc. (ATI Systems) Emergency Mass Notification Systems
Sources
Also known as GHSA-fpp6-xw3r-cjjx.