CVE-2018-9112

A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges by modifying cookies.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gist.github.com/ChuanYuan-Huang/a92b8b32980123d5fa9bf5a8299114bf	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:foxconn:ap-fc4064-t_firmware:ap_gt_b38_5.8.3lb15-w47_lte:*:*:*:*:*:*:*

cpe:2.3:h:foxconn:ap-fc4064-t:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-05-10 03:29

Updated : 2024-02-04 19:46

NVD link : CVE-2018-9112

Mitre link : CVE-2018-9112

CVE.ORG link : CVE-2018-9112

JSON object : View

Products Affected

foxconn

ap-fc4064-t
ap-fc4064-t_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2018-9112", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-05-10T03:29:00.513", "references": [{"url": "https://gist.github.com/ChuanYuan-Huang/a92b8b32980123d5fa9bf5a8299114bf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges by modifying cookies."}, {"lang": "es", "value": "Existe una cuenta de administrador con pocos privilegios con una contrase\u00f1a de administrador d\u00e9bil por defecto en Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. Adem\u00e1sm su p\u00e1gina de gesti\u00f3n web depende de la existencia de valores de cookies al realizar operaciones cr\u00edticas para la seguridad. Se podr\u00edan obtener privilegios modificando cookies."}], "lastModified": "2018-06-18T16:39:46.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:foxconn:ap-fc4064-t_firmware:ap_gt_b38_5.8.3lb15-w47_lte:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1996692-932A-4397-8DB9-C55C4D362FB5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:foxconn:ap-fc4064-t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1BCB6BAB-3889-48DB-8C47-0E525338E69A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}