PT-2018-14422 · Orange · Orange Airbox

Syrex1013 · Publicado 2018-10-16 · Atualizado 2019-10-03 · CVE-2018-18375

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orange AirBox Y858 FL 01.16 04

Description The issue allows attackers to extract APN data, including name, number, username, and password, via the rand parameter in the "goform/getProfileList" API endpoint.

Recommendations For Orange AirBox Y858 FL 01.16 04, as a temporary workaround, consider restricting access to the "goform/getProfileList" API endpoint until a patch is available. Avoid using the rand parameter in this endpoint to minimize the risk of exploitation.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2018-18375

Produtos afetados

Orange Airbox

Referências · 3

• 🔥 https://github.com/remix30303/AirBoxAPNLeaks · Exploit
• https://osv.dev/vulnerability/CVE-2018-18375 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18375 · Nota de Segurança