CVE-2018-16158

Eaton Xpert Meter SSH Private Key Exposure Scanner

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins (to uid 0) via the PubkeyAuthentication option.

Los dispositivos Eaton Power Xpert Meter 4000, 6000 y 8000 en versiones anteriores a la 13.4.0.10 tienen una única clave privada SSH en las diferentes instalaciones de clientes y no restringen correctamente el acceso a dicha clave, lo que facilita que atacantes remotos realicen inicios de sesión SSH (a uid 0) mediante la opción PubkeyAuthentication.

Eaton Power Xpert Meters running firmware below version 12.x.x.x or below version 13.3.x.x ship with a public/private key pair that facilitate remote administrative access to the devices. Tested on: Firmware 12.1.9.1 and 13.3.2.10.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-08-30 CVE Reserved
2018-08-30 CVE Published
2020-08-24 First Exploit
2024-09-17 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-798: Use of Hard-coded Credentials

CAPEC

References (4)

URL	Tag	Source
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf

URL	Date	SRC
https://github.com/BrianWGray/msf/blob/master/exploits/linux/ssh/eaton_known_privkey.rb	2020-08-24
https://www.ctrlu.net/vuln/0006.html	2024-09-17

URL	Date	SRC

URL	Date	SRC
http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf	2020-08-24

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Eaton Search vendor "Eaton"	Power Xpert Meter 4000 Firmware Search vendor "Eaton" for product "Power Xpert Meter 4000 Firmware"	< 13.4.0.10 Search vendor "Eaton" for product "Power Xpert Meter 4000 Firmware" and version " < 13.4.0.10"	-	Affected	in	Eaton Search vendor "Eaton"	Power Xpert Meter 4000 Search vendor "Eaton" for product "Power Xpert Meter 4000"	-	-	Safe
Eaton Search vendor "Eaton"	Power Xpert Meter 6000 Firmware Search vendor "Eaton" for product "Power Xpert Meter 6000 Firmware"	< 13.4.0.10 Search vendor "Eaton" for product "Power Xpert Meter 6000 Firmware" and version " < 13.4.0.10"	-	Affected	in	Eaton Search vendor "Eaton"	Power Xpert Meter 6000 Search vendor "Eaton" for product "Power Xpert Meter 6000"	-	-	Safe
Eaton Search vendor "Eaton"	Power Xpert Meter 8000 Firmware Search vendor "Eaton" for product "Power Xpert Meter 8000 Firmware"	< 13.4.0.10 Search vendor "Eaton" for product "Power Xpert Meter 8000 Firmware" and version " < 13.4.0.10"	-	Affected	in	Eaton Search vendor "Eaton"	Power Xpert Meter 8000 Search vendor "Eaton" for product "Power Xpert Meter 8000"	-	-	Safe