Read the docs
TI-2017-05285 Aliases CVE-2017-7649GHSA-wqfv-xx2r-h6v5

Improper authentication in Eclipse Kura Installer

Priority MEDIUM 45CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.

Why it matters now

EPSS 0.01647 76th percentileScored 2026-11-07
Fix Fixed Eclipse Kura Installer (Eclipse Foundation): 2.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Kura Installerbefore 2.1.02.1.0Patch availableCNA
  • Eclipse Kura Installer VendorEclipse Foundation Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:*up to 2.0.2VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:* Versions up to 2.0.2 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA Eclipse Kura Installer (Eclipse Foundation) Fixed in 2.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7649
  2. 2026-10-03 Alias added: GHSA-wqfv-xx2r-h6v5

References

Advisory 2

  • TI-2026-08399 Insufficient verification of data authenticity in Eclipse Kura CVSS 4.0HIGH 8.8
  • TI-2024-02852 In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically… CVSS 3.1HIGH 7.5
  • TI-2019-07559 XML external entity injection in Eclipse Kura CVSS 3.0HIGH 7.5
  • TI-2019-07557 Path traversal in Eclipse Kura CVSS 3.0MEDIUM 5.3
  • TI-2019-07558 Information disclosure in Eclipse Kura CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences