CVE-2012-4898

Tropos Wireless Mesh Routers Insufficient Entropy

Description

Mesh OS before 7.9.1.1 on Tropos wireless mesh routers does not use a sufficient source of entropy for SSH keys, which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation elsewhere.

Remediation

Solution:

  • Tropos Networks has released customer notification and an update (Tropos Mesh OS 7.9.1.1) for its network device embedded software. This update can be downloaded from the Tropos software download page. Download of the update requires a valid user name and password. The updated firmware fixes the vulnerability by using sufficient entropy to generate unique SSH host keys.

Category

6.1
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 0.25%
Affected: Tropos Mesh OS
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/news-events/ics-advisories/icsa-12-297-01
http://www.us-cert.gov/control_systems/pdf/ICSA-12-297-01.pdf us government resource

Frequently Asked Questions

What is the severity of CVE-2012-4898?
CVE-2012-4898 has been scored as a medium severity vulnerability.
How to fix CVE-2012-4898?
To fix CVE-2012-4898: Tropos Networks has released customer notification and an update (Tropos Mesh OS 7.9.1.1) for its network device embedded software. This update can be downloaded from the Tropos software download page. Download of the update requires a valid user name and password. The updated firmware fixes the vulnerability by using sufficient entropy to generate unique SSH host keys.
Is CVE-2012-4898 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2012-4898 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2012-4898?
CVE-2012-4898 affects Tropos Mesh OS.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.