CVE-2018-8859

State: Published
Severity: 9.8 Critical
Published: Jul 24, 2018
Updated: Jun 2, 2026
Reserved: Mar 20, 2018

Description

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-288 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288

Affected Products

Product	Versions
SmartServer 1Echelon	all versionsAffected
SmartServer 2Echelon	all versions prior to release 4.11.007Affected
i.LON 100Echelon	all versionsAffected
i.LON 600Echelon	all versionsAffected

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.