PT-2018-10799 · Nec · Nec Univerge Sv9100 Webpro

Hyp3Rlinx · Publicado 2018-12-26 · Atualizado 2021-09-13 · CVE-2018-11742

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NEC Univerge Sv9100 WebPro version 6.00.00

Description The issue concerns cleartext password storage in the Web UI. This means that passwords are stored in a plaintext format, which can be easily accessed by unauthorized parties.

Recommendations For NEC Univerge Sv9100 WebPro version 6.00.00, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-11742

Produtos afetados

Nec Univerge Sv9100 Webpro

Referências · 7

• 🔥 https://exploit-db.com/exploits/45942 · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Dec/1 · Exploit
• https://t.me/cvenotify/20735 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-11742 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11742 · Nota de Segurança