NVD Vulnerability Detail

CVE-2013-0137

Summary	The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session.
Publication Date	July 1, 2013, 4:28 a.m.
Registration Date	Jan. 26, 2021, 3:32 p.m.
Last Update	Nov. 21, 2024, 10:46 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:h:monroe_electronics:r189_one-net_eas::::::::		2.0-1
cpe:2.3:h:monroe_electronics:r189_one-net_eas:2.0-0:::::::*
cpe:2.3:h:digital_alert_systems:dasdec_eas:2.0-0:::::::*
cpe:2.3:h:digital_alert_systems:dasdec_eas::::::::		2.0-1

Related information, measures and tools

No	URL	タグ
1	http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf	Vendor Advisory
2	http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf	Vendor Advisory
3	http://www.kb.cert.org/vuls/id/662676	US Government Resource
4	http://www.kb.cert.org/vuls/id/662676	US Government Resource
5	http://www.kb.cert.org/vuls/id/AAMN-98MU7H
6	http://www.kb.cert.org/vuls/id/AAMN-98MU7H
7	http://www.kb.cert.org/vuls/id/AAMN-98MUK2	US Government Resource
8	http://www.kb.cert.org/vuls/id/AAMN-98MUK2	US Government Resource
9	http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf	Vendor Advisory
10	http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf	Vendor Advisory
11	https://securityledger.com/2020/01/seven-years-later-scores-of-eas-systems-sit-un-patched-vulnerable/
12	https://securityledger.com/2020/01/seven-years-later-scores-of-eas-systems-sit-un-patched-vulnerable/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-310	暗号の問題	https://cwe.mitre.org/data/definitions/310.html

JVN Vulnerability Information

Digital Alert Systems DASDEC EAS および Monroe Electronics R189 One-Net EAS における root アクセス権を取得される脆弱性

Title	Digital Alert Systems DASDEC EAS および Monroe Electronics R189 One-Net EAS における root アクセス権を取得される脆弱性
Summary	Digital Alert Systems DASDEC EAS デバイスおよび Monroe Electronics R189 One-Net EAS デバイスのデフォルト設定は、既知の SSH 秘密鍵を含むため、root アクセス権を取得される、および警告を偽装される脆弱性が存在します。
Possible impacts	第三者により、SSH セッションを介して、root アクセス権を取得される、および警告を偽装される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 24, 2013, midnight
Registration Date	July 2, 2013, 4:48 p.m.
Last Update	July 2, 2013, 4:48 p.m.

Affected System

Monroe Electronics

R189 One-Net EAS 2.0-2 未満

Digital Alert Systems

DASDEC EAS 2.0-2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-0137	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0137
National Vulnerability Database (NVD)
2	CVE-2013-0137	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0137

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-310	https://jvndb.jvn.jp/ja/cwe/CWE-310.html

ベンダー情報

No	Name	URL
Digital Alert Systems
1	Monroe Electronics Provides New Software Update Enhancing Security and Functionality	http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf
Monroe Electronics
2	Monroe Electronics Provides New Software Update Enhancing Security and Functionality	http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf
富士通セキュリティ情報
3	TA13-175A	http://software.fujitsu.com/jp/security/vulnerabilities/ta13-175a.html

その他

No	Name	URL
JVN
1	JVNVU#99235742	http://jvn.jp/cert/JVNVU99235742
US-CERT Technical Cyber Security Alert
2	TA13-175A	http://www.us-cert.gov/ncas/alerts/TA13-175A
US-CERT Vulnerability Note
3	Digital Alert Systems Information for VU#662676	http://www.kb.cert.org/vuls/id/AAMN-98MUK2
4	Monroe Electronics Information for VU#662676	http://www.kb.cert.org/vuls/id/AAMN-98MU7H
5	VU#662676	http://www.kb.cert.org/vuls/id/662676

Change Log

No	Changed Details	Date of change
0	[2013年07月02日] 掲載	Feb. 17, 2018, 10:37 a.m.