CVE-2018-6020

MEDIUM

Silex SD-320AN <2.01, GEH-SD-320AN <GEH-1.1, GEH-500 <1.54, SX-500 - Unauthenticated System Settings Modification

Title source: llm
STIX 2.1

Description

In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSMA-18-128-01

Scores

CVSS v3 6.5
EPSS 0.0108
EPSS Percentile 60.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Details

CWE
CWE-287
Status published
Products (4)
silextechnology/geh-500_firmware < 1.54
silextechnology/geh-sd-320an_firmware < geh-1.1
silextechnology/sd-320an_firmware < 2.01
silextechnology/sx-500_firmware
Published May 09, 2018
Tracked Since Feb 18, 2026