CVE-2009-1477

Published May 27, 2009

Last updated 6 years ago

Overview

Description: The https web interfaces on the ATEN KH1516i IP KVM switch with firmware 1.0.063, the KN9116 IP KVM switch with firmware 1.1.104, and the PN9108 power-control unit have a hardcoded SSL private key, which makes it easier for remote attackers to decrypt https sessions by extracting this key from their own switch and then sniffing network traffic to a switch owned by a different customer.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 10
Impact score: 10
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

nvd@nist.gov: CWE-310

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:aten:kh1516i_ip_kvm_switch:1.0.063:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F67B9DD1-E02A-4C5B-A580-BFD9ABD8A8E2"
          },
          {
            "criteria": "cpe:2.3:h:aten:kn9116_ip_kvm_switch:1.1.104:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C48202DF-1036-45C0-AEBB-6F133649D537"
          },
          {
            "criteria": "cpe:2.3:h:aten:pn9108_power_over_the_net:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BFDE53F8-D607-44AF-8379-A0C1FD71BF7C"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References