VulnerabilityModified
CVE-2016-2509
The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password, which allows remote attackers to obtain…
MEDIUM 5.3EPSS 0.80%
Does this matter?
Lower severity and a low EPSS score (0.80%). Track it; it rarely justifies an emergency change on its own.
Description
The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password, which allows remote attackers to obtain sensitive information by sniffing the network.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.80% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- belden/hirschmann firmware · belden/hirschmann l2b
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/507216Third Party Advisory, US Government Resource
- https://www.belden.com/resourcecenter/security/upload/Belden_Security_Advisory_BSECV-2016-2_1v0.pdfVendor Advisory
- http://www.kb.cert.org/vuls/id/507216Third Party Advisory, US Government Resource
- https://www.belden.com/resourcecenter/security/upload/Belden_Security_Advisory_BSECV-2016-2_1v0.pdfVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.