CVE Details for CVE: CVE-2016-2333
Summary
SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' installations, which allows attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
| Timestamps | |
|---|---|
| Last major update | 04-05-2016 - 19:33 |
| Published | 25-04-2016 - 18:59 |
| Last modified | 04-05-2016 - 19:33 |
References
Vulnerable Configurations
CAPEC
Click the CAPEC title to display a description
-
Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CWE
CVSS
Base
5.0
Impact
2.9
Exploitability
10.0
Access
| Vector | Complexity | Authentication |
|---|---|---|
| NETWORK | LOW | NONE |
Impact
| Confidentiality | Integrity | Availability |
|---|---|---|
| PARTIAL | NONE | NONE |
CVSS3
Base
7.5
Impact
3.6
Exploitability
3.9
Access
| Attack Complexity | Attack vector | Privileges Required | Scope | User Interaction |
|---|---|---|---|---|
| LOW | NETWORK | NONE | UNCHANGED | NONE |
Impact
| Confidentiality | Integrity | Availability |
|---|---|---|
| HIGH | NONE | NONE |