vulnwire
6.6med

CVE-2017-6911

USB Pratirodh is prone to sensitive information disclosure.

Published 9 y ago · modified 4 mo ago · JSON

CVSS
6.6
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known

USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack.

Exploit prediction (EPSS)

0.57% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.6CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-922 Insecure Storage of Sensitive Information

References

  • securityfocus.com /bid/96970 · vdb-entry, x_refsource_BID, x_transferred
  • packetstormsecurity.com /files/141651/USB-Pratirodh-Insecure-Password-Storage.html · x_refsource_MISC, x_transferred
  • seclists.org /fulldisclosure/2017/Mar/43 · mailing-list, x_refsource_FULLDISC, x_transferred
  • securityfocus.com /archive/1/540289/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.