{"id":"CVE-2018-8859","state":"PUBLISHED","title":"Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required au","description":"Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product.","publishedAt":"2018-07-24T17:00:00.000Z","updatedAt":"2026-06-02T19:43:22.063Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"icscert","products":["Echelon SmartServer 1","Echelon SmartServer 2","Echelon i.LON 100","Echelon i.LON 600"],"affected":[{"vendor":"Echelon","product":"SmartServer 1","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Echelon","product":"SmartServer 2","versions":[{"version":"all versions prior to release 4.11.007","status":"affected"}]},{"vendor":"Echelon","product":"i.LON 100","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Echelon","product":"i.LON 600","versions":[{"version":"all versions","status":"affected"}]}],"references":["https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03"],"weaknesses":["CWE-288"],"ingestedAt":"2026-10-29T19:45:03.125Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2018/8xxx/CVE-2018-8859.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2018-8859","state":"PUBLISHED","datePublished":"2018-07-24T17:00:00.000Z","dateUpdated":"2026-06-02T19:43:22.063Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2018-03-20T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product."}],"affected":[{"vendor":"Echelon","product":"SmartServer 1","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Echelon","product":"SmartServer 2","versions":[{"version":"all versions prior to release 4.11.007","status":"affected"}]},{"vendor":"Echelon","product":"i.LON 100","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Echelon","product":"i.LON 600","versions":[{"version":"all versions","status":"affected"}]}],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-288","description":"AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","dateUpdated":"2018-07-24T16:57:01.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6"},"datePublic":"2018-07-19T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","DATE_PUBLIC":"2018-07-19T00:00:00","ID":"CVE-2018-8859","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SmartServer 1","version":{"version_data":[{"version_value":"all versions"}]}},{"product_name":"SmartServer 2","version":{"version_data":[{"version_value":"all versions prior to release 4.11.007"}]}},{"product_name":"i.LON 100","version":{"version_data":[{"version_value":"all versions"}]}},{"product_name":"i.LON 600","version":{"version_data":[{"version_value":"all versions"}]}}]},"vendor_name":"Echelon"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288"}]}]},"references":{"reference_data":[{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-200-03","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T07:10:46.232Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-06-02T19:43:18.812812Z","id":"CVE-2018-8859","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-02T19:43:22.063Z"}}]}}}