CVE-2015-3960

Published: Aug 4, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.

Affected (2)

Products: Garrettcom: Magnum 10k Firmware, Magnum 6k Firmware

2 products

Magnum 10k Firmware

Magnum 6k Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Garrettcom Magnum 10k Firmware	Up to 4.5.5
Garrettcom Magnum 6k Firmware	Up to 4.5.5

Related CWEs

References (6)

http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf

Source: ics-cert@hq.dhs.gov

Vendor Advisory

http://www.securityfocus.com/bid/75236

Source: ics-cert@hq.dhs.gov

https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/75236

Source: af854a3a-2127-422b-91ae-364da2661108

https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.