CVE•Published 2018-07-24•Modified 2026-06-02•1 article on news•5 live references•NVD data

CVE-2018-8859Echelon · Smartserver_1_firmware

Vulnerability data via NVD (ingested)

CVSS v3.1

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 46% of all CVEs

Weaknesses (CWE)

CWE-288Authentication Bypass Using an Alternate Path or Channel CWE-287Improper Authentication

Description

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required authentication specified in the security configuration file by including extra characters in the directory name when specifying the directory to be accessed. This vulnerability does not affect the i.LON 600 product.

Timeline

Published 2018-07-24

Modified 2026-06-02

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2018-8859

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · OS

os:"Smartserver 1 Firmware"

Hosts Shodan identified as running Smartserver 1 Firmware.

More intel sources (5)

Shodan report

vuln:CVE-2018-8859

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2018-8859