var-201709-0051
Vulnerability from variot

OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V3, OpenStage 60 and OpenScape Desk Phone IP 55G HFA V3, OpenStage 15, 20E, 20, and 40 and OpenScape Desk Phone IP 35G HFA V3, and OpenScape Desk Phone IP 35G Eco HFA V3 use non-unique X.509 certificates and SSH host keys. Many embedded devices are not unique X.509 Certificate and SSH Spoofing and intermediary because host key is used (man-in-the-middle) There is a possibility of being attacked and attacks such as decryption of communication contents. The encryption key is hard-coded (CWE-321) SEC Consult of Stefan Viehböck According to the survey, many embedded devices are not unique X.509 Certificate and SSH It is said that it is accessible from the Internet using a host key. A hard-coded key in a firmware image or a repository stored by scanning the Internet scans.io ( In particular SSH And the result of SSL Certificate ) A device that uses a certificate whose fingerprint matches the data of can be determined to be vulnerable. Affected devices include household routers and IP From the camera VoIP Wide range of products. CWE-321: Use of Hard-coded Cryptographic Key http://cwe.mitre.org/data/definitions/321.html scans.io https://scans.io/ SSH Result of https://scans.io/series/ssh-rsa-full-ipv4 SSL Certificate https://scans.io/study/sonar.ssl In many vulnerable devices, certificate and key reuse is limited to a limited product line by a specific developer, but there are several examples where multiple developers use the same certificate or key. Or exist. These are common SDK Firmware developed using, or ISP Provided by OEM The root cause is the use of device firmware. Vulnerable equipment is impersonation and intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. Perhaps the attacker can obtain authentication information and other sensitive information and use it for further attacks. Survey results and certificates SSH For more information on systems affected by host key issues, see SEC Consult See the blog post. Certificate https://www.sec-consult.com/download/certificates.html SSH Host key https://www.sec-consult.com/download/ssh_host_keys.html SEC Consult http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.htmlA remote attacker impersonates a user or intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. As a result, confidential information may be leaked. UnifyOpenStage60 and so on are all IP phones from Unify. A remote attacker could exploit the vulnerability to exploit a man-in-the-middle attack or decrypt communication between legitimate users and devices

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201709-0051",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "openscape desk phone ip 35g hfa",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openscape desk phone ip 55g sip",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openstage 60",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openstage 20",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openscape desk phone ip 35g eco sip",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openstage 40",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openscape desk phone ip 55g hfa",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openstage 20e",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openscape desk phone ip 35g sip",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": "openstage 15",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "unify",
        "version": "3.0"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "actiontec",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "general electric",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "netcomm",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "sierra",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "technicolor",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ubiquiti",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "unify",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "zte",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "c1000z",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "fr1000z",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "gs1900-24",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "gs1900-8",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1100-n",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1100-nh",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1121-ni",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1123-ac",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1123-ni",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "p-660hn-51",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "p-663hn-51",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "p8702n",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "pmg5318-b20a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "q1000",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "sbg3300-n000",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "sbg3300-nb00",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "sbg3500-n000",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg1312-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg1312-b30a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg1312-b30b",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg4380-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg8324-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg8924-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg8924-b30a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vsg1435-b101",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "",
        "scope": null,
        "trust": 0.8,
        "vendor": "multiple vendors",
        "version": null
      },
      {
        "model": "openstage",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "60"
      },
      {
        "model": "openscape desk phone ip 55g sip",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "v3"
      },
      {
        "model": "openscape desk phone ip 35g sip",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "v3"
      },
      {
        "model": "openstage",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "40"
      },
      {
        "model": "openstage",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "20"
      },
      {
        "model": "openstage 20e",
        "scope": null,
        "trust": 0.6,
        "vendor": "unify",
        "version": null
      },
      {
        "model": "openstage",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "15"
      },
      {
        "model": "openscape desk phone ip 55g hfa",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "v3"
      },
      {
        "model": "openscape desk phone ip 35g hfa",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "v3"
      },
      {
        "model": "openscape desk phone ip 35g eco hfa",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "unify",
        "version": "v3"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:zyxel:c1000z_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:fr1000z_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:gs1900-24_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:gs1900-8_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1100-n_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1100-nh_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1121-ni_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1123-ac_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1123-ni_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:p-660hn-51_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:p-663hn-51_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:p8702n_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:pmg5318-b20a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:q1000_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:sbg3300-n000_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:sbg3300-nb00_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:sbg3500-n000_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg1312-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg1312-b30a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg1312-b30b_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg4380-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg8324-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg8924-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg8924-b30a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vsg1435-b101_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:misc:multiple_vendors",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      }
    ]
  },
  "cve": "CVE-2015-8251",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2015-8251",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2015-8251",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CNVD-2017-33799",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-86212",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "id": "CVE-2015-8251",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-8251",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-8251",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-33799",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201709-1157",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-86212",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "db": "VULHUB",
        "id": "VHN-86212"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V3, OpenStage 60 and OpenScape Desk Phone IP 55G HFA V3, OpenStage 15, 20E, 20, and 40 and OpenScape Desk Phone IP 35G HFA V3, and OpenScape Desk Phone IP 35G Eco HFA V3 use non-unique X.509 certificates and SSH host keys. Many embedded devices are not unique X.509 Certificate and SSH Spoofing and intermediary because host key is used (man-in-the-middle) There is a possibility of being attacked and attacks such as decryption of communication contents. The encryption key is hard-coded (CWE-321) SEC Consult of Stefan Viehb\u0026#246;ck According to the survey, many embedded devices are not unique X.509 Certificate and SSH It is said that it is accessible from the Internet using a host key. A hard-coded key in a firmware image or a repository stored by scanning the Internet scans.io ( In particular SSH And the result of SSL Certificate ) A device that uses a certificate whose fingerprint matches the data of can be determined to be vulnerable. Affected devices include household routers and IP From the camera VoIP Wide range of products. CWE-321: Use of Hard-coded Cryptographic Key http://cwe.mitre.org/data/definitions/321.html scans.io https://scans.io/ SSH Result of https://scans.io/series/ssh-rsa-full-ipv4 SSL Certificate https://scans.io/study/sonar.ssl In many vulnerable devices, certificate and key reuse is limited to a limited product line by a specific developer, but there are several examples where multiple developers use the same certificate or key. Or exist. These are common SDK Firmware developed using, or ISP Provided by OEM The root cause is the use of device firmware. Vulnerable equipment is impersonation and intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. Perhaps the attacker can obtain authentication information and other sensitive information and use it for further attacks. Survey results and certificates SSH For more information on systems affected by host key issues, see SEC Consult See the blog post. Certificate https://www.sec-consult.com/download/certificates.html SSH Host key https://www.sec-consult.com/download/ssh_host_keys.html SEC Consult http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.htmlA remote attacker impersonates a user or intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. As a result, confidential information may be leaked. UnifyOpenStage60 and so on are all IP phones from Unify. A remote attacker could exploit the vulnerability to exploit a man-in-the-middle attack or decrypt communication between legitimate users and devices",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-8251"
      },
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "db": "VULHUB",
        "id": "VHN-86212"
      }
    ],
    "trust": 2.97
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#566724",
        "trust": 3.9
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8251",
        "trust": 3.1
      },
      {
        "db": "JVN",
        "id": "JVNVU96100360",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "84118",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-86212",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "db": "VULHUB",
        "id": "VHN-86212"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "id": "VAR-201709-0051",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "db": "VULHUB",
        "id": "VHN-86212"
      }
    ],
    "trust": 1.192671785
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      }
    ]
  },
  "last_update_date": "2024-11-23T22:25:43.534000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Zyxel to Fix SSH Private Key and Certificate Vulnerability (CVE-2015-7256)",
        "trust": 0.8,
        "url": "http://www.zyxel.com/support/announcement_SSH_private_key_and_certificate_vulnerability.shtml"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-86212"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "http://www.kb.cert.org/vuls/id/566724"
      },
      {
        "trust": 1.7,
        "url": "https://networks.unify.com/security/advisories/obso-1511-02-a.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://networks.unify.com/security/advisories/obso-1511-02.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://www.kb.cert.org/vuls/id/bluu-a2ppze"
      },
      {
        "trust": 1.6,
        "url": "http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.html"
      },
      {
        "trust": 0.8,
        "url": "http://blog.sec-consult.com/2016/09/house-of-keys-9-months-later-40-worse.html"
      },
      {
        "trust": 0.8,
        "url": "https://www.sec-consult.com/download/certificates.html"
      },
      {
        "trust": 0.8,
        "url": "https://www.sec-consult.com/download/ssh_host_keys.html"
      },
      {
        "trust": 0.8,
        "url": "https://scans.io/"
      },
      {
        "trust": 0.8,
        "url": "https://scans.io/series/ssh-rsa-full-ipv4"
      },
      {
        "trust": 0.8,
        "url": "https://scans.io/study/sonar.ssl"
      },
      {
        "trust": 0.8,
        "url": "https://censys.io"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6358"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7255"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7256"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7276"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8251"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu96100360/index.html"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7256"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-6358"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7255"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7276"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8251"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "db": "VULHUB",
        "id": "VHN-86212"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "db": "VULHUB",
        "id": "VHN-86212"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-11-25T00:00:00",
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "date": "2017-11-14T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "date": "2017-09-25T00:00:00",
        "db": "VULHUB",
        "id": "VHN-86212"
      },
      {
        "date": "2016-02-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "date": "2017-09-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      },
      {
        "date": "2017-09-25T21:29:00.913000",
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-09-06T00:00:00",
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "date": "2017-11-14T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-33799"
      },
      {
        "date": "2017-10-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-86212"
      },
      {
        "date": "2018-02-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "date": "2017-11-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      },
      {
        "date": "2024-11-21T02:38:10.943000",
        "db": "NVD",
        "id": "CVE-2015-8251"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Embedded devices use non-unique X.509 certificates and SSH host keys",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201709-1157"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.