Lucene search

MitreCVE-2018-13862

HistoryJul 17, 2018 - 2:29 p.m.

CVE-2018-13862

2018-07-1714:29:00

mitre

web.nvd.nist.gov

cve-2018-13862

touchpad

trivum webtouch setup

remote attack

authentication reset

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.144

Percentile

95.8%

JSON

Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attackers to reset the authentication via the “/xml/system/setAttribute.xml” URL, using the GET request “?id=0&attr=protectAccess&newValue=0” (a successful attack will allow attackers to login without authorization).

Affected configurations

Nvd

Node

trivumwebtouch_setup_v9_firmwareMatch2.53

AND

trivumwebtouch_setup_v9Match-

VendorProductVersionCPE
trivumwebtouch_setup_v9_firmware2.53cpe:2.3:o:trivum:webtouch_setup_v9_firmware:2.53:*:*:*:*:*:*:*
trivumwebtouch_setup_v9-cpe:2.3:h:trivum:webtouch_setup_v9:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trivum	webtouch_setup_v9_firmware	2.53	cpe:2.3:o:trivum:webtouch_setup_v9_firmware:2.53:::::::*
trivum	webtouch_setup_v9	-	cpe:2.3:h:trivum:webtouch_setup_v9:-:::::::*

References

update.trivum.com/update/tp9-changes.html

vulncode.com/advisory/CVE-2018-13862

www.exploit-db.com/exploits/45063/

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.144

Percentile

95.8%

JSON

Related for CVE-2018-13862