SSH Key Vulnerability in Eaton Power Xpert Meter Devices
CVE-2018-16158
9.8CRITICAL
Summary
Eaton Power Xpert Meter devices 4000, 6000, and 8000 prior to version 13.4.0.10 are susceptible to an SSH key vulnerability stemming from a shared private SSH key across various customer installations. This oversight allows unauthorized remote attackers to gain SSH access to devices using the PubkeyAuthentication feature, potentially compromising critical control and monitoring capabilities.
References
EPSS Score
67% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability Reserved
Vulnerability published