CVE Feed

    Dashboard / CVE / CVE-2017-13663

    CVE-2017-13663

    Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed key.

    Published:Dec 1, 2017
    Last Modified:Apr 20, 2025
    EPS:Dec 1, 2017
    EPSS Score:0.00075
    CVSS Score:7.5

    Affected Products

    Vendor
    Ismartalarm
    Product
    Cubeone
    Vendor
    Ismartalarm
    Product
    Cubeone Firmware

    Exploits

    https://poppopretn.com/2017/11/30/public-disclosure-firmware-vulnerabilities-in-ismartalarm-cubeone/https://poppopretn.com/2017/11/30/public-disclosure-firmware-vulnerabilities-in-ismartalarm-cubeone/

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-37 Retrieve Embedded Sensitive Data

    Related CVEs

    CVE-2018-16224 (CVSS 5.3) — Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attac…
    CVE-2017-13664 (CVSS 9.8) — Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to exec…
    CVE-2017-7726 (CVSS 7.5) — iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.…
    CVE-2017-7728 (CVSS 9.8) — On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., set…
    CVE-2017-7729 (CVSS 7.5) — On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext…
    CVE-2017-7730 (CVSS 7.5) — iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High