CVE-2018-8855

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Echelon	SmartServer 1	all versions
Echelon	SmartServer 2	all versions prior to release 4.11.007
Echelon	i.LON 100	all versions
Echelon	i.LON 600	all versions

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03Third Party Advisory, US Government Resource

Timeline

Published: Jul 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-88569.8Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for enc CVE-2018-88577.8Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.CVE-2018-88589.8If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) the CVE-2018-88599.8Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions CVE-2018-88606.5In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker may be able to capture firmware updates through the adjacent network.CVE-2018-88618.7Vulnerabilities within the Philips Brilliance CT kiosk environment (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and CVE-2018-88623.1In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability CVE-2018-88637.5The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information.CVE-2018-88643.1In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vu CVE-2018-88659.8In Lantech IDS 2102 2.0 and prior, a stack-based buffer overflow vulnerability has been identified which may allow remote code execution. A CVE-2018-88668.8In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker on an adjacent network could perform command injection.CVE-2018-88677.5In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems