Lucene search

MitreCVE-2018-20512

HistoryJan 03, 2019 - 7:29 p.m.

CVE-2018-20512

2019-01-0319:29:01

CWE-565

mitre

web.nvd.nist.gov

cve-2018-20512

epon

cpe-wifi

privilege escalation

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.007

Percentile

79.7%

JSON

EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.

Affected configurations

Nvd

Node

cdatatecepon_cpe-wifi_devices_firmwareMatch2.0.4-x000

AND

cdatatecfd108bnMatch-

cdatatecfd111hzMatch-

cdatatecfd111yMatch-

cdatatecfd114yMatch-

cdatatecfd212gwMatch-

cdatatecfd212hMatch-

cdatatecfd214ghMatch-

cdatatecfd214gwMatch-

cdatatecfd404ghMatch-

cdatatecfd404gwMatch-

cdatatecfd600-104Match-

cdatatecfd600-104gMatch-

cdatatecfd600-108f-hz500Match-

cdatatecfd600-111gMatch-

cdatatecfd600-111gwMatch-

cdatatecfd600-301Match-

cdatatecfd600-301gwMatch-

cdatatecfd600-304Match-

cdatatecfd600-304ga-hr500Match-

cdatatecfd600-304ga-hr511Match-

cdatatecfd600-521gMatch-

VendorProductVersionCPE
cdatatecepon_cpe-wifi_devices_firmware2.0.4-x000cpe:2.3:o:cdatatec:epon_cpe-wifi_devices_firmware:2.0.4-x000:*:*:*:*:*:*:*
cdatatecfd108bn-cpe:2.3:h:cdatatec:fd108bn:-:*:*:*:*:*:*:*
cdatatecfd111hz-cpe:2.3:h:cdatatec:fd111hz:-:*:*:*:*:*:*:*
cdatatecfd111y-cpe:2.3:h:cdatatec:fd111y:-:*:*:*:*:*:*:*
cdatatecfd114y-cpe:2.3:h:cdatatec:fd114y:-:*:*:*:*:*:*:*
cdatatecfd212gw-cpe:2.3:h:cdatatec:fd212gw:-:*:*:*:*:*:*:*
cdatatecfd212h-cpe:2.3:h:cdatatec:fd212h:-:*:*:*:*:*:*:*
cdatatecfd214gh-cpe:2.3:h:cdatatec:fd214gh:-:*:*:*:*:*:*:*
cdatatecfd214gw-cpe:2.3:h:cdatatec:fd214gw:-:*:*:*:*:*:*:*
cdatatecfd404gh-cpe:2.3:h:cdatatec:fd404gh:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cdatatec	epon_cpe-wifi_devices_firmware	2.0.4-x000	cpe:2.3:o:cdatatec:epon_cpe-wifi_devices_firmware:2.0.4-x000:::::::*
cdatatec	fd108bn	-	cpe:2.3:h:cdatatec:fd108bn:-:::::::*
cdatatec	fd111hz	-	cpe:2.3:h:cdatatec:fd111hz:-:::::::*
cdatatec	fd111y	-	cpe:2.3:h:cdatatec:fd111y:-:::::::*
cdatatec	fd114y	-	cpe:2.3:h:cdatatec:fd114y:-:::::::*
cdatatec	fd212gw	-	cpe:2.3:h:cdatatec:fd212gw:-:::::::*
cdatatec	fd212h	-	cpe:2.3:h:cdatatec:fd212h:-:::::::*
cdatatec	fd214gh	-	cpe:2.3:h:cdatatec:fd214gh:-:::::::*
cdatatec	fd214gw	-	cpe:2.3:h:cdatatec:fd214gw:-:::::::*
cdatatec	fd404gh	-	cpe:2.3:h:cdatatec:fd404gh:-:::::::*

Rows per page:

1-10 of 221

References

www.reddit.com/r/networking/comments/abu4kq/vulnerability_in_cdata_technologies_epon_cpewifi/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.007

Percentile

79.7%

JSON

Related for CVE-2018-20512