{"cve":"CVE-2017-7649","nvd":{"published":"2017-09-11T16:29:00.213","modified":"2026-06-17T01:24:53.000","status":"Modified","description":"The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox \"exec\" command. As the process is running as \"root\" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-287"],"references":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681","https://github.com/eclipse/kura/issues/956","https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681","https://github.com/eclipse/kura/issues/956"],"products":["eclipse:kura"],"source":"nvd","synced_at":"2026-10-19T20:46:01.145313090+00:00"},"epss":{"cve":"CVE-2017-7649","score":0.01647,"percentile":0.76475,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}