Bab-technologie
Bab-technologie Eibport Firmware: vulnerabilidades y CVE
Bab-technologie Eibport Firmware tiene 7 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE7
Últimos 12 meses0
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-28914 | Media (6.5) | 1.0% | — | 9 sept 2021 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not enforced. This is usable and part of an attack chain to gain… |
| CVE-2021-28913 | Crítica (9.8) | 1.8% | — | 9 sept 2021 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so called and hard coded unique 'eibPort String' which acts as the root SSH key… |
| CVE-2021-28912 | Alta (7.2) | 1.2% | — | 9 sept 2021 | BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access. |
| CVE-2021-28911 | Crítica (9.8) | 1.7% | — | 9 sept 2021 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial number). Having those info, a possible loginId can be… |
| CVE-2021-28910 | Alta (7.5) | 1.2% | — | 9 sept 2021 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. It allow unauthenticated attackers to request to any internal and external server. |
| CVE-2021-28909 | Crítica (9.8) | 1.4% | — | 9 sept 2021 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default… |
| CVE-2020-24573 | Alta (7.5) | 1.4% | — | 12 nov 2020 | BAB TECHNOLOGIE GmbH eibPort V3 prior to 3.8.3 devices allow denial of service (Uncontrolled Resource Consumption) via requests to the lighttpd component. |