CVEvulnerability
CVE-2015-3960
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-08-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.
Affected configurations
• garrettcom magnum 10k firmware (<= 4.5.5)
• garrettcom magnum 6k firmware (<= 4.5.5)
Related
Weakness · not in database (1)
References
- http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf Vendor Advisory
- http://www.securityfocus.com/bid/75236 www.securityfocus.com
- https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01 Third Party Advisory, US Government Resource
- http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf Vendor Advisory
- http://www.securityfocus.com/bid/75236 www.securityfocus.com
- https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01 Third Party Advisory, US Government Resource