CVE-2018-8855

State: Published
Severity: 9.8 Critical
Published: Jul 24, 2018
Updated: Jun 2, 2026
Reserved: Mar 20, 2018

Description

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-319 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319

Affected Products

Product	Versions
SmartServer 1Echelon	all versionsAffected
SmartServer 2Echelon	all versions prior to release 4.11.007Affected
i.LON 100Echelon	all versionsAffected
i.LON 600Echelon	all versionsAffected

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.