PT-2017-17659 · Humax · Humax Digital Hg100R

The Gambler · Publicado 2017-07-04 · Atualizado 2019-10-03 · CVE-2017-7315

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Humax Digital HG100R version 2.0.6

Description An issue was discovered where it is not necessary to use credentials to download the backup file. The router credentials are stored in plaintext inside the backup file, referred to as GatewaySettings.bin.

Recommendations For Humax Digital HG100R version 2.0.6, consider changing the router credentials and storing them securely to minimize the risk of exploitation. As a temporary workaround, restrict access to the backup file to prevent unauthorized downloads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-306

CWE-522

Identificadores relacionados

CVE-2017-7315

Produtos afetados

Humax Digital Hg100R

Referências · 3

• 🔥 http://seclists.org/fulldisclosure/2017/Jun/45 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7315 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7315 · Aviso do Fabricante