« Back to list

CVE-2017-3222

Status: ModifiedCritical (9.8)—

Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Inmarsat — Amosconnect

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-3222",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Inmarsat",
          "product": "AmosConnect",
          "versions": [
            {
              "status": "affected",
              "version": "8.0, 8.0.1, 8.0.2, 8.2.0, 8.2.1, 8.2.2, 8.3.0, 8.3.1, 8.4.0, 8.4.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-22T20:29:00.250",
  "references": [
    {
      "url": "http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/99899",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://twitter.com/mkolsek/status/923988845783322625",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/586501",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/99899",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://twitter.com/mkolsek/status/923988845783322625",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/586501",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cret@cert.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager."
    },
    {
      "lang": "es",
      "value": "Las credenciales codificadas en AmosConnect 8, permiten a atacantes remotos alcanzar privilegios administrativos completos, incluida la capacidad de ejecutar comandos en la plataforma host de Microsoft Windows con privilegios SYSTEM mediante la violación del Administrador de tareas de AmosConnect."
    }
  ],
  "lastModified": "2026-06-17T01:17:45.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEFBF35E-464C-4D0A-994C-6E0D2BF2EEF5"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4841016-AE8E-427E-88C6-8652E536E8AC"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C9D4054-A8F3-40FC-A847-7E3E99080310"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64224E85-F3E8-4B45-B877-9EF3CB04FDD1"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE5C8665-64A6-4DAF-A6AC-ABF12EAD4268"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93FE4D18-037A-4DCD-97EF-0513B2B4BB74"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0C811BF-607D-4663-8406-9E67C66192FE"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "829663CA-7449-49D6-A063-BC52DFB49D1F"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE3754FB-1AD8-4EA4-81BE-FBC457F465D8"
            },
            {
              "criteria": "cpe:2.3:a:inmarsat:amosconnect:8.4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72E82817-1484-4C5F-9F18-0FD9AEE74F0C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}