CVE-2018-15555

Опубликовано: 28 июн. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onboard UART headers.

Ссылки

http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Jun/1
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jun/1
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Jun/1
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Jun/1
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:actiontec:web6000q_firmware:1.1.02.22:*:*:*:*:*:*:*

cpe:2.3:h:actiontec:web6000q:-:*:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01156

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-662

Связанные уязвимости

GHSA-234w-xgj2-p772

github

около 3 лет назад