PT-2018-1046 · Iball · Iball Ib-Wra150N

Publicado 2018-01-29 · Atualizado 2018-02-15 · CVE-2018-6387

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iBall iB-WRA150N version 1.2.6 build 110401 Rel.47776n

Description The issue is related to the use of predefined credentials in the device's firmware. An attacker can exploit this to gain administrative access to the device remotely. The device has hardcoded passwords for its accounts, including admin for the admin account, support for the support account, and user for the user account.

Recommendations For iBall iB-WRA150N version 1.2.6 build 110401 Rel.47776n, consider changing the hardcoded passwords for the admin, support, and user accounts to unique and strong passwords to prevent unauthorized access. As a temporary workaround, restrict remote access to the device until the issue is resolved.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2018-00351

CVE-2018-6387

Produtos afetados

Iball Ib-Wra150N

Referências · 4

• 🔥 https://blogs.securiteam.com/index.php/archives/3654 · Exploit
• https://osv.dev/vulnerability/CVE-2018-6387 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6387 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00351 · Nota de Segurança