« Volver al listado

CVE-2013-4732

Estado: ModificadaAlta (10)—

The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU#662676 states "Monroe Electronics could not reproduce this finding.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Digital Alert Systems — Dasdec EASMonroe Electronics — R189 One-net EAS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4732",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-06-30T19:28:10.173",
  "references": [
    {
      "url": "http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/662676",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/AAMN-98MU7H",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/AAMN-98MUK2",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/662676",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/AAMN-98MU7H",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/AAMN-98MUK2",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network.  NOTE: VU#662676 states \"Monroe Electronics could not reproduce this finding."
    },
    {
      "lang": "es",
      "value": "** EN DISPUTA ** El servidor Web de administración del dispositivo Digital Alert Systems DASDEC EAS hasta v2.0-2 y el dispositivo Monroe Electronics R189 One-Net hasta v2.0-2 use un ID de sesión predecible, lo que permite a los atacantes remotos secuestrar la sesión de los usuarios mediante  EAS utiliza valores de ID de sesión predecibles, lo que hace que sea más fácil para los atacantes remotos secuestrar sesiones mediante la captura de datos de red (\"sniffing\"). NOTA: VU#662676 dice que. Monroe Electronics no puede reproducir este hallazgo\""
    }
  ],
  "lastModified": "2026-06-16T23:57:48.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digital_alert_systems:dasdec_eas:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A6190CC-FD4E-4CF2-81CE-9E108EF4B7B4",
              "versionEndIncluding": "2.0-2"
            },
            {
              "criteria": "cpe:2.3:h:digital_alert_systems:dasdec_eas:2.0-0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "308B32AD-1091-4528-964B-7394D54B1D4E"
            },
            {
              "criteria": "cpe:2.3:h:digital_alert_systems:dasdec_eas:2.0-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F56C2F8-B2EC-4A96-898A-EAD3D02B7A6C"
            },
            {
              "criteria": "cpe:2.3:h:monroe_electronics:r189_one-net_eas:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03F1A7BA-78B3-4ED0-947D-2CADF4A981D9",
              "versionEndIncluding": "2.0-2"
            },
            {
              "criteria": "cpe:2.3:h:monroe_electronics:r189_one-net_eas:2.0-0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90C5BDD8-C91B-44EB-870E-FABEFCFA5F7B"
            },
            {
              "criteria": "cpe:2.3:h:monroe_electronics:r189_one-net_eas:2.0-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72D48CEF-FD5C-4547-A1A6-7FBF509AA12A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}