« Volver al listado

CVE-2018-6624

Estado: ModificadaCrítica (9.8)—

OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Omron — NS Series Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-6624",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-02-05T18:29:00.390",
  "references": [
    {
      "url": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html."
    },
    {
      "lang": "es",
      "value": "Los dispositivos OMRON NS desde la versión 1.1 hasta la 1.3 permite que los atacantes remotos omitan la autenticación mediante una petición directa al archivo .html para una pantalla específica, tal y como queda demostrado en monitor.html."
    }
  ],
  "lastModified": "2026-06-17T02:02:06.853",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:omron:ns_series_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EF95403-DE01-4ABF-B877-6EC88268FCDC",
              "versionEndIncluding": "1.3",
              "versionStartIncluding": "1.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:omron:ns10:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1D65A565-79CF-48F7-89AA-B25D4126BC30"
            },
            {
              "criteria": "cpe:2.3:h:omron:ns12:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D5C66177-8822-4330-AB4E-0D18C06B4889"
            },
            {
              "criteria": "cpe:2.3:h:omron:ns15:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1ADD9BA5-F03C-4B69-A088-A46C08C90DC4"
            },
            {
              "criteria": "cpe:2.3:h:omron:ns5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "095B49B3-A9A3-448A-B07B-7921285920B7"
            },
            {
              "criteria": "cpe:2.3:h:omron:ns8:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "360BDC8D-811F-4F63-9FFC-A81C6617D376"
            },
            {
              "criteria": "cpe:2.3:h:omron:nsh5:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F131D0DE-3CD9-4EFF-9D0E-8B6A896DEA9F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}