CVE Vulnerabilities

CVE-2018-12925

Weak Password Requirements

Published: Jun 28, 2018 | Modified: Oct 03, 2019
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
10 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

Baseon Lantronix MSS devices do not require a password for TELNET access.

Weakness

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Affected Software

Name Vendor Start Version End Version
Mss_firmware Lantronix - (including) - (including)

Potential Mitigations

  • A product’s design should require adherance to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes:

  • Depending on the threat model, the password policy may include several additional attributes.

  • See NIST 800-63B [REF-1053] for further information on password requirements.

References