CVE-2017-3222

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Inmarsat	AmosConnect	8.0, 8.0.1, 8.0.2, 8.2.0, 8.2.1, 8.2.2, 8.3.0, 8.3.1, 8.4.0, 8.4.0.1

References

http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/Vendor Advisory
http://www.securityfocus.com/bid/99899Third Party Advisory, VDB Entry
https://twitter.com/mkolsek/status/923988845783322625Third Party Advisory
https://www.kb.cert.org/vuls/id/586501Third Party Advisory, US Government Resource
http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/Vendor Advisory
http://www.securityfocus.com/bid/99899Third Party Advisory, VDB Entry
https://twitter.com/mkolsek/status/923988845783322625Third Party Advisory
https://www.kb.cert.org/vuls/id/586501Third Party Advisory, US Government Resource

Timeline

Published: Jul 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-32239.8Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be CVE-2017-32248.2Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSe CVE-2017-32254.6Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encrypt CVE-2017-32266.4Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC CVE-2017-32308.6Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported version CVE-2017-32314.3Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected CVE-2017-32325.5Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32337.5Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32349.8Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th CVE-2017-32353.5Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported v CVE-2017-32364.7Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported v CVE-2017-32377.8Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th