CVE-2018-10627

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. This vulnerability does not affect the i.LON 600 product.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Echelon	SmartServer 1	all versions
Echelon	SmartServer 2	all versions prior to release 4.11.007
Echelon	i.LON 100	all versions
Echelon	i.LON 600	all versions

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03Third Party Advisory, US Government Resource

Timeline

Published: Jul 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-106289.8AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a CVE-2018-10634.4Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELin CVE-2018-106309.8For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication di CVE-2018-106316.3The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 A CVE-2018-106327.5In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not res CVE-2018-106339.8Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset CVE-2018-106344.8Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker co CVE-2018-106359.8In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code CVE-2018-106368.8CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could caus CVE-2018-106377.8A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Ele CVE-2018-10647.5libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU CVE-2018-106418.1D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext.