Vulnerabilities > CVE-2017-3962 - Use of Password Hash With Insufficient Computational Effort vulnerability in Mcafee Network Security Manager

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

mcafee

CWE-916

critical

NVD

Published: 2018-06-12

Updated: 2023-11-07

Summary

Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes.

Vulnerable Configurations

Part	Description	Count
Application	Mcafee Mcafee Network Security Manager 6.1.15 Mcafee Network Security Manager 6.1.15.38 Mcafee Network Security Manager 6.1.15.39 Mcafee Network Security Manager 7.1.5 Mcafee Network Security Manager 7.1.5.14 Mcafee Network Security Manager 7.1.5.15 Mcafee Network Security Manager 7.1.15 Mcafee Network Security Manager 7.1.15.6 Mcafee Network Security Manager 7.1.15.7 Mcafee Network Security Manager 7.5.5 Mcafee Network Security Manager 7.5.5.8 Mcafee Network Security Manager 7.5.5.9 Mcafee Network Security Manager 8.1.7 Mcafee Network Security Manager 8.1.7.2 Mcafee Network Security Manager 8.1.7.3	15

Common Weakness Enumeration (CWE)

CWE-916 - Use of Password Hash With Insufficient Computational Effort

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10192