Korenix JetNet Hardcoded Cryptographic Key and Hardcoded Credentials Security Bypass Vulnerabilities

Bugtraq ID:	101598
Class:	Design Error
CVE:	CVE-2017-14021 CVE-2017-14027
Remote:	Yes
Local:	No
Published:	Oct 26 2017 12:00AM
Updated:	Dec 19 2017 08:00PM
Credit:	Mandar Jadhav of the Qualys Vulnerability Signature/Research Team
Vulnerable:	Korenix JetNet6710G-HVDC 1.1e Korenix JetNet6710G 1.1 Korenix JetNet5828G 1.1d Korenix JetNet5728G-24P 1.4 Korenix JetNet5628G-R 1.4 Korenix JetNet5628G 1.4 Korenix JetNet5428G-2G-2FX 1.4 Korenix JetNet5310G 1.4A Korenix JetNet5018G 1.4
Not Vulnerable:

Korenix JetNet Hardcoded Cryptographic Key and Hardcoded Credentials Security Bypass Vulnerabilities

Korenix JetNet is prone to a hard-coded cryptographic key vulnerability and security-bypass vulnerability.

An attacker can exploit these issues to bypass the security mechanism and perform unauthorized actions or perform man-in-the middle attacks and obtain sensitive information. This may aid in further attacks.

Korenix JetNet Hardcoded Cryptographic Key and Hardcoded Credentials Security Bypass Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Korenix JetNet Hardcoded Cryptographic Key and Hardcoded Credentials Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Korenix JetNet Hardcoded Cryptographic Key and Hardcoded Credentials Security Bypass Vulnerabilities

References:

• Korenix Homepage (Korenix)
  
• ICSA-17-299-01: Korenix JetNet (CERT)