LiveActive security incident?Get immediate response
CVE Record

CVE-2018-1000628: Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct...

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supplied value in PHP's GET global variable array using PHP's strcmp() function. By adding "[]" to the end of "key" in the URL when accessing API functions, an attacker could exploit this vulnerability to execute API functions.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

Battelle V2I Hub 2.5.1 has an API-key validation flaw that may let a remote attacker bypass intended security checks and run API functions. The public record does not provide a CVSS score, patch details, or broader affected-version data.

Executive priority

Treat this as a targeted exposure review, not a confirmed mass-exploitation emergency. Prioritize if V2I Hub APIs support operational transportation workflows or are reachable from external networks.

Technical view

The CVE describes direct comparison of an API key from PHP GET input using strcmp(). A malformed user-supplied key parameter can alter comparison behavior and bypass the API-key check, allowing API functions to execute without valid authentication.

Likely exposure

Exposure appears limited to organizations running Battelle V2I Hub 2.5.1, especially where API endpoints are reachable by untrusted networks. The source bundle does not identify other versions, CPEs, or deployment patterns.

Exploitation context

CISA KEV status is false, and the provided sources do not claim active exploitation. The issue is remotely reachable when vulnerable API functions are exposed, but public evidence in the bundle is sparse.

Researcher notes

The record lacks CVSS, CWE, fixed-version, and precise affected-product metadata beyond the description naming Battelle V2I Hub 2.5.1. Validate against local code and vendor materials before expanding scope.

Mitigation direction

  • Check Battelle or project guidance for fixed versions or configuration changes.
  • Restrict network access to V2I Hub API endpoints.
  • Remove public internet exposure for affected API services where possible.
  • Review API-key handling for type-safe validation behavior.
  • Monitor logs for unexpected API function execution.

Validation and detection

  • Inventory systems for Battelle V2I Hub 2.5.1 deployments.
  • Confirm whether API endpoints are reachable from untrusted networks.
  • Review authentication code or vendor notes for the described strcmp behavior.
  • Check web logs for malformed key parameters and anomalous API activity.
  • Verify compensating access controls are enforced around API paths.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-1000628 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.