CVE-2012-3006 json
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD befo…
published 2012-06-19 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-2984
- cvss
- 7.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.
Patch / fix
- innominate mguard_firmware 7.5.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-12-167-01 updated cvss 7.1
Innominate MGuard Weak HTTPS and SSH Keys
-
Innominate EAGLE mGuard HW-201000, BD-301010 Innominate mGuard Blade HW-104020, HW-104050 Innominate mGuard Delta HW-103050, BD-201000 Innominate mGuard Industrial RS HW-105000, BD-501000, BD-501010, BD-501020 Innominate mGuard PCI HW-102020, HW-102050, BD-111010, BD-111020 Innominate mGuard Smart HW-101020, HW-101050, BD-101010, BD-101020affected: mitigation
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Exploit prediction
1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.1 | AV:N/AC:H/Au:S/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-310 Cryptographic Issues
References
-
innominate.com
/data/downloads/software/innominate_security_advisory_20120614_001.pdf
vendor-advisory
-
freedom-to-tinker.com
/blog/nadiah/new-research-theres-no-need-panic-over-factorable-keys-just-mind-your-ps-and-qs
not-applicable
-
us-cert.gov
/control_systems/pdf/ICSA-12-167-01.pdf
broken-link, third-party-advisory, us-government-resource
Sources
- CVE List CVE-2012-3006
- NVD CVE-2012-3006
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.