CVE-2018-18960

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP to find certain devices on the network, but the default version is v2c, allowing an amplification attack.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/epistemophilia/CVEs/blob/master/Epson-WorkForce-WF2861/CVE-2018-18960/poc-cve-2018-18960.py	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.48_lq22i3:::::::*
	cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.51.lq20i6:::::::*
	cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.52.lq17ia:::::::*

cpe:2.3:h:epson:epson_workforce_wf-2861:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-12-24 17:29

Updated : 2024-02-04 20:03

NVD link : CVE-2018-18960

Mitre link : CVE-2018-18960

CVE.ORG link : CVE-2018-18960

JSON object : View

Products Affected

epson

epson_workforce_wf-2861
epson_workforce_wf-2861_firmware

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2018-18960", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2018-12-24T17:29:00.347", "references": [{"url": "https://github.com/epistemophilia/CVEs/blob/master/Epson-WorkForce-WF2861/CVE-2018-18960/poc-cve-2018-18960.py", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP to find certain devices on the network, but the default version is v2c, allowing an amplification attack."}, {"lang": "es", "value": "Se ha descubierto un problema en dispositivos Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 y 10.52.LQ17IA. Emplean SNMP para encontrar ciertos dispositivos en la red, pero la versi\u00f3n por defecto es v2c, lo que permite un ataque de amplificaci\u00f3n."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.48_lq22i3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4632EEE5-3459-4503-ADAB-9AA3E18C9B53"}, {"criteria": "cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.51.lq20i6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B04ED1A-63D4-4E8F-BA06-6D86D88E538D"}, {"criteria": "cpe:2.3:o:epson:epson_workforce_wf-2861_firmware:10.52.lq17ia:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBF6BA43-888F-484A-B953-0D3C043CEDD1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:epson:epson_workforce_wf-2861:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9956990F-90B0-4AC9-AEBE-8959583E7ED3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}