CVE-2017-7649: Critical severity eclipse kura vulnerability
The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7649?
CVE-2017-7649 has a medium severity score due to the risk of unauthorized access and potential command execution.
How do I fix CVE-2017-7649?
To fix CVE-2017-7649, upgrade Kura to version 2.1.0 or later where the IPv6 firewall rules and console security are improved.
What specific vulnerabilities are present in CVE-2017-7649?
CVE-2017-7649 allows logging into the Kura console without credentials via unencrypted telnet, combined with inadequate firewall rule configuration.
What devices are affected by CVE-2017-7649?
Devices running Eclipse Kura versions prior to 2.1.0 are affected by CVE-2017-7649.
Is CVE-2017-7649 related to any network protocols?
Yes, CVE-2017-7649 is specifically related to the unencrypted telnet protocol and firewall management over IPv6.