CVE-2018-8851

State: Published
Severity: 9.8 Critical
Published: Jul 24, 2018
Updated: Jun 2, 2026
Reserved: Mar 20, 2018

Description

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store passwords in plaintext, which may allow an attacker with access to the configuration file to log into the SmartServer web user interface.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-256 UNPROTECTED STORAGE OF CREDENTIALS CWE-256

Affected Products

Product	Versions
SmartServer 1Echelon	all versionsAffected
SmartServer 2Echelon	all versions prior to release 4.11.007Affected
i.LON 100Echelon	all versionsAffected
i.LON 600Echelon	all versionsAffected

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.