CVE-2016-2333
HighSummary
SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 use the same hardcoded encryption key across different customers' installations, allowing attackers to defeat cryptographic protection mechanisms.
Risk Assessment
The use of the same encryption key across different installations poses a risk that attackers may gain access to cryptographically protected data, potentially leading to a breach of confidentiality.
Recommendation
It is recommended to update the firmware to version 01A.8 or later to eliminate the issue with the hardcoded encryption key and to implement unique encryption keys for each installation.
Other vulnerabilities in SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway
See all- CVE-2016-2332High
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before version 01A.8 has a vulnerability in the flu.cgi file that allows remote authenticated users to execute arbitrary commands via the 5066 (dnsmasq) parameter.
- CVE-2016-2331Critical
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
Original NVD description (English source)
SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' installations, which allows attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.