CVE-2012-4898
Tropos Wireless Mesh Routers Insufficient Entropy
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
Mesh OS before 7.9.1.1 on Tropos wireless mesh routers does not use a sufficient source of entropy for SSH keys, which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation elsewhere.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | Medium6.1 | AV:N/AC:H/Au:N/C:C/I:P/A:N |
| NVDNVD · Modified | 2.0 | Medium6.1 | AV:N/AC:H/Au:N/C:C/I:P/A:N |
- EPSS (exploitation in 30 days)
- 0.99% · top 37% of all CVEs (2 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Weakness
- CWE 331
- CWE-310 (opens in a new tab)
Affected products
Tropos · Mesh OS
- affected < 7.9.1.1
What to do
Solution: Tropos Networks has released customer notification and an update (Tropos Mesh OS 7.9.1.1) for its network device embedded software. This update can be downloaded from the Tropos software download page. Download of the update requires a valid user name and password. The updated firmware fixes the vulnerability by using sufficient entropy to generate unique SSH host keys.
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .