CVE-2018-8862

low-risk

Published 2018-05-25

In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.1/10 Low

ADJACENT_NETWORK / HIGH complexity

Affected Products (4)

Hpss16 Firmware

Hpss32 Firmware

Mhpss Firmware

Alert4000 Firmware

Affected Vendors

Atisystem

References (4)

Third Party Advisory http://www.securityfocus.com/bid/103721

Mitigation https://ics-cert.us-cert.gov/advisories/ICSA-18-100-01

Third Party Advisory http://www.securityfocus.com/bid/103721

Mitigation https://ics-cert.us-cert.gov/advisories/ICSA-18-100-01

/ 100

low-risk

Severity 8/34 · Low

Exploitability 1/34 · Minimal

Exposure 10/34 · Low