« Volver al listado

CVE-2017-3222

Estado: ModificadaCrítica (9.8)—

Las credenciales codificadas en AmosConnect 8, permiten a atacantes remotos alcanzar privilegios administrativos completos, incluida la capacidad de ejecutar comandos en la plataforma host de Microsoft Windows con privilegios SYSTEM mediante la violación del Administrador de tareas de AmosConnect.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Inmarsat — Amosconnect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-3222",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Inmarsat",
          "product": "AmosConnect",
          "versions": [
            {
              "status": "affected",
              "version": "8.0, 8.0.1, 8.0.2, 8.2.0, 8.2.1, 8.2.2, 8.3.0, 8.3.1, 8.4.0, 8.4.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-22T20:29:00.250",
  "references": [
    {
      "url": "http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/99899",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://twitter.com/mkolsek/status/923988845783322625",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/586501",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/99899",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://twitter.com/mkolsek/status/923988845783322625",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/586501",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cret@cert.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager."
    },
    {
      "lang": "es",
      "value": "Las credenciales codificadas en AmosConnect 8, permiten a atacantes remotos alcanzar privilegios administrativos completos, incluida la capacidad de ejecutar comandos en la plataforma host de Microsoft Windows con privilegios SYSTEM mediante la violación del Administrador de tareas de AmosConnect."
    }
  ],
  "lastModified": "2026-06-17T01:17:45.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEFBF35E-464C-4D0A-994C-6E0D2BF2EEF5"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4841016-AE8E-427E-88C6-8652E536E8AC"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C9D4054-A8F3-40FC-A847-7E3E99080310"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64224E85-F3E8-4B45-B877-9EF3CB04FDD1"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE5C8665-64A6-4DAF-A6AC-ABF12EAD4268"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93FE4D18-037A-4DCD-97EF-0513B2B4BB74"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0C811BF-607D-4663-8406-9E67C66192FE"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "829663CA-7449-49D6-A063-BC52DFB49D1F"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE3754FB-1AD8-4EA4-81BE-FBC457F465D8"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72E82817-1484-4C5F-9F18-0FD9AEE74F0C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}