CVE-2018-10627

State: Published
Severity: 9.8 Critical
Published: Jul 24, 2018
Updated: Jun 2, 2026
Reserved: May 1, 2018

Description

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. This vulnerability does not affect the i.LON 600 product.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-200 INFORMATION EXPOSURE CWE-200

Affected Products

Product	Versions
SmartServer 1Echelon	all versionsAffected
SmartServer 2Echelon	all versions prior to release 4.11.007Affected
i.LON 100Echelon	all versionsAffected
i.LON 600Echelon	all versionsAffected

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.