CVE-2017-7649 - CVE House

Back to Database

Status published Critical CVE-2017-7649

The network enabled distribution of Kura before 2.1.0 takes control...

9.8 CVSS

Vulnerability Description

The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-7649

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Eclipse Foundation

View All →

In Jakarta Mail versions prior to 2.0.2 it is possible...

A vulnerability in the Eclipse Open VSX Registry’s automated publishing...

A denial-of-service vulnerability exists in the NetX IPv6 component functionality...

Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()

Affected Vendor

Eclipse Foundation

View all reports →

Affected Software

Eclipse Kura Installer

Vulnerable Versions:

unspecified

Timeline

Official Publish: September 11th, 2017

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.