CVE-2017-7649 json
The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules…
published 2017-09-11 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16654
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.
Patch / fix
- Eclipse Foundation Eclipse Kura Installer 2.1.0
Exploit prediction
1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Eclipse Foundation Eclipse Kura Installer
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
bugs.eclipse.org
/bugs/show_bug.cgi?id=514681
third-party-advisory
-
github.com
/eclipse/kura/issues/956
third-party-advisory
Sources
- CVE List CVE-2017-7649
- NVD CVE-2017-7649
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.