vulnwire
9.8crit

CVE-2017-3222

Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute com…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
7.4%
percentile 94%
Public exploits
0
none known

Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.

Exploit prediction (EPSS)

7.41% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Inmarsat AmosConnect

Classification

Weakness
  • CWE-798 Use of Hard-coded Credentials

References

  • inmarsat.com /news/inmarsat-response-to-ioactive-claims/ · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/99899 · vdb-entry, x_refsource_BID, x_transferred
  • twitter.com /mkolsek/status/923988845783322625 · x_refsource_MISC, x_transferred
  • kb.cert.org /vuls/id/586501 · third-party-advisory, x_refsource_CERT-VN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.