VulnerabilityModified
CVE-2017-3222
Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.
CRITICAL 9.8EPSS 7.41%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 7.41% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-798
- Affected
- inmarsat/amosconnect
- Source
- cret@cert.org
References
- http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/Vendor Advisory
- http://www.securityfocus.com/bid/99899Third Party Advisory, VDB Entry
- https://twitter.com/mkolsek/status/923988845783322625Third Party Advisory
- https://www.kb.cert.org/vuls/id/586501Third Party Advisory, US Government Resource
- http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/Vendor Advisory
- http://www.securityfocus.com/bid/99899Third Party Advisory, VDB Entry
- https://twitter.com/mkolsek/status/923988845783322625Third Party Advisory
- https://www.kb.cert.org/vuls/id/586501Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.