CVE-2018-8119

moderate-risk

Published 2018-05-09

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C# SDK, C SDK, Java SDK.

Do I need to act?

1.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.6/10 Medium

NETWORK / HIGH complexity

Affected Products (3)

C Software Development Kit

Csharp Software Development Kit

Java Software Development Kit

Affected Vendors

Microsoft

References (5)

Third Party Advisory http://www.securityfocus.com/bid/104070

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119

Third Party Advisory https://tools.cisco.com/security/center/viewAlert.x?alertId=57754&vs_f=Alert%20R...

Third Party Advisory http://www.securityfocus.com/bid/104070

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 3/34 · Minimal

Exposure 9/34 · Low