CVE-2010-2966

Severity Score

7.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The INCLUDE_SECURITY functionality in Wind River VxWorks 6.x, 5.x, and earlier uses the LOGIN_USER_NAME and LOGIN_USER_PASSWORD (aka LOGIN_PASSWORD) parameters to create hardcoded credentials, which makes it easier for remote attackers to obtain access via a (1) telnet, (2) rlogin, or (3) FTP session.

La funcionalidad INCLUDE_SECURITY en Wind River VxWorks v6.x, v5.x, y anteriores usa los parámetros LOGIN_USER_NAME y LOGIN_USER_PASSWORD (conocido como LOGIN_PASSWORD) para crear credenciales fijas, que sea fácil para atacantes remotos obtener acceso a través de sesiones (1) telnet, (2) rlogin, o (3) FTP.

*Credits: N/A

CVSS Scores

NISTv2 7.8

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-08-04 CVE Reserved
2010-08-04 CVE Published
2024-09-16 CVE Updated
2024-09-16 First Exploit
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-255: Credentials Management Errors

CAPEC

References (2)

URL	Tag	Source
http://www.kb.cert.org/vuls/id/840249	Third Party Advisory

URL	Date	SRC
http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html	2024-09-16

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Windriver Search vendor "Windriver"		Vxworks Search vendor "Windriver" for product "Vxworks"				<= 6.8 Search vendor "Windriver" for product "Vxworks" and version " <= 6.8"		-		Affected
Windriver Search vendor "Windriver"		Vxworks Search vendor "Windriver" for product "Vxworks"				5 Search vendor "Windriver" for product "Vxworks" and version "5"		-		Affected
Windriver Search vendor "Windriver"		Vxworks Search vendor "Windriver" for product "Vxworks"				5.5 Search vendor "Windriver" for product "Vxworks" and version "5.5"		-		Affected
Windriver Search vendor "Windriver"		Vxworks Search vendor "Windriver" for product "Vxworks"				6 Search vendor "Windriver" for product "Vxworks" and version "6"		-		Affected
Windriver Search vendor "Windriver"		Vxworks Search vendor "Windriver" for product "Vxworks"				6.4 Search vendor "Windriver" for product "Vxworks" and version "6.4"		-		Affected