CVE-2013-4732
Published Jun 30, 2013
Last updated 3 months ago
Overview
- Description
- The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU#662676 states "Monroe Electronics could not reproduce this finding.
- Source
- cve@mitre.org
- NVD status
- Modified
- CNA Tags
- disputed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 10
- Impact score
- 10
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
- nvd@nist.gov
- CWE-255
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:digital_alert_systems:dasdec_eas:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A6190CC-FD4E-4CF2-81CE-9E108EF4B7B4",
"versionEndIncluding": "2.0-2"
},
{
"criteria": "cpe:2.3:h:digital_alert_systems:dasdec_eas:2.0-0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "308B32AD-1091-4528-964B-7394D54B1D4E"
},
{
"criteria": "cpe:2.3:h:digital_alert_systems:dasdec_eas:2.0-1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F56C2F8-B2EC-4A96-898A-EAD3D02B7A6C"
},
{
"criteria": "cpe:2.3:h:monroe_electronics:r189_one-net_eas:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03F1A7BA-78B3-4ED0-947D-2CADF4A981D9",
"versionEndIncluding": "2.0-2"
},
{
"criteria": "cpe:2.3:h:monroe_electronics:r189_one-net_eas:2.0-0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90C5BDD8-C91B-44EB-870E-FABEFCFA5F7B"
},
{
"criteria": "cpe:2.3:h:monroe_electronics:r189_one-net_eas:2.0-1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72D48CEF-FD5C-4547-A1A6-7FBF509AA12A"
}
],
"operator": "OR"
}
]
}
]