CVE-2017-7649
CriticalSummary
Kura before version 2.1.0 has a vulnerability that allows taking control over the device's firewall configuration, but does not allow setting IPv6 firewall rules. The Equinox console port 5002 remains open, allowing login to Kura without user credentials over unencrypted telnet and executing commands as 'root'.
Risk Assessment
The organization is exposed to full control over the device, which can lead to serious security breaches and data loss. The open telnet connection without authentication poses a risk of unauthorized access.
Recommendation
It is recommended to update Kura to version 2.1.0 or later to eliminate this vulnerability. Additionally, close port 5002 and disable telnet to minimize the risk of unauthorized access.
Original NVD description (English source)
The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.