CVE-2018-15720 - OpenCVE

Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Logitech	Harmony Hub Firmware Harmony Hub

Configuration 1 [-]

AND

cpe:2.3:o:logitech:harmony_hub_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:logitech:harmony_hub:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.tenable.com/security/research/tra-2018-47	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: tenable

Published: 2018-12-19T00:00:00

Updated: 2018-12-20T20:57:01

Reserved: 2018-08-22T00:00:00

Link: CVE-2018-15720

JSON object: View

NVD Information

Status : Modified

Published: 2018-12-20T21:29:00.633

Modified: 2019-10-09T23:35:50.080

Link: CVE-2018-15720

JSON object: View

Redhat Information

No data.

CWE

CWE-798

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:logitech:harmony_hub_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1A7B59C-D2E9-4A22-9BFC-1B51E310C2B7", "versionEndExcluding": "4.15.206", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:logitech:harmony_hub:-:*:*:*:*:*:*:*", "matchCriteriaId": "BDBF64B5-F971-4A8F-A76B-A5DF75D23DF5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API."}, {"lang": "es", "value": "Logitech Harmony Hub, en versiones anteriores a la 4.15.206, conten\u00eda dos cuentas embebidas en el servidor XMPP que otorgaba a los usuarios remotos acceso a la API local."}], "id": "CVE-2018-15720", "lastModified": "2019-10-09T23:35:50.080", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-20T21:29:00.633", "references": [{"source": "vulnreport@tenable.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.tenable.com/security/research/tra-2018-47"}], "sourceIdentifier": "vulnreport@tenable.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "vulnreport@tenable.com", "type": "Secondary"}]}