Vulnerabilities > CVE-2017-13992 - Insufficient Entropy vulnerability in Loytec Lvis-3Me Firmware 6.1.1

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
high complexity
loytec
CWE-331
NVD
Published: 2017-10-05
Updated: 2019-10-09

Summary

An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution.

Vulnerable Configurations

Part Description Count
OS
Loytec
1
Hardware
Loytec
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

References