What is CVE-2018-5401?

CVE-2018-5401 is a critical-severity vulnerability in Arm Arm7, classified under Cleartext Transmission of Sensitive Information. CVSS score: 9.1/10. Published 2018-10-08.

How severe is CVE-2018-5401?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Arm Arm7

CVE-2018-5401

The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The devices transmit process control information via unencrypted Modbus communications. Impact: An attacker can exploit this vulnerability to observe information about configurations, settings, what sensors are present and in use, and other information to aid in crafting spoofed messages. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7.

EPSS: 0.009 (55.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Arm Arm7
Auto-maskin Dcu-210e — versions 3.7
Auto-maskin Dcu_210e
Auto-maskin Dcu_210e_firmware
Auto-maskin Marine_pro_observer
Auto-maskin Marine Pro Observer Android App — versions 0.1
Auto-maskin Rp-210e — versions 3.7
Auto-maskin Rp_210e
Auto-maskin Rp_210e_firmware

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
cret@cert.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2018-5401?: CVE-2018-5401 is a critical-severity vulnerability in Arm Arm7, classified under Cleartext Transmission of Sensitive Information. CVSS score: 9.1/10. Published 2018-10-08.
How severe is CVE-2018-5401?: Critical severity. CVSS v3 base score is 9.1 out of 10.