Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-15485: KONE Group Controller allows unauthenticated FTP access

CVE-2018-15485 · published 8 years ago

Summary

The FTP service on KONE Group Controller firmware before version 4.6.5 can be reached without a username or password, letting anyone connect to the device. This could let an attacker view, change, or add files on the controller. Update the firmware to version 4.6.5 or newer, or disable the FTP service until it is patched.

What to do

Update kone group_controller_firmware to version 4.6.5 or later.

Affected software

Vendor	Product	Affected versions
kone	group_controller_firmware	< 4.6.5 `cpe:2.3:o:kone:group_controller_firmware::::::::`

Original advisory text

An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03.

References

http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LF... Third Party Advisory VDB Entry
https://www.kone.com/en/vulnerability.aspx Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.1 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published7 Sep 2018

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-15485 · NVD

Track software like this

Free during beta