ByteOS Network

NVD Vulnerability Details :

CVE-2015-3959

Deferred

Source-ics-cert@hq.dhs.gov

Published At-04 Aug, 2015 | 01:59

Updated At-12 Apr, 2025 | 10:46

The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 7.2

Base severity: HIGH

Vector:

AV:L/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

garrettcom>>magnum_10k_firmware>>Versions up to 4.5.5(inclusive)

cpe:2.3:o:garrettcom:magnum_10k_firmware:*:*:*:*:*:*:*:*

garrettcom>>magnum_6k_firmware>>Versions up to 4.5.5(inclusive)

cpe:2.3:o:garrettcom:magnum_6k_firmware:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-Other	Primary	nvd@nist.gov

CWE ID: NVD-CWE-Other

Type: Primary

Source: nvd@nist.gov

Evaluator Description

CWE-798: Use of Hard-coded Credentials

References

Hyperlink	Source	Resource
http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf	ics-cert@hq.dhs.gov	Vendor Advisory
http://www.securityfocus.com/bid/75235	ics-cert@hq.dhs.gov	N/A
https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01	ics-cert@hq.dhs.gov	Third Party Advisory US Government Resource
http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://www.securityfocus.com/bid/75235	af854a3a-2127-422b-91ae-364da2661108	N/A
https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource