PT-2018-14423 · Orange · Orange Airbox

Publicado 2018-10-16 · Atualizado 2018-12-06 · CVE-2018-18376

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Orange AirBox Y858 FL 01.16 04

Description The issue allows remote attackers to discover information about currently connected devices, including hostnames, IP addresses, MAC addresses, and connection time, by exploiting the goform/getWlanClientInfo endpoint using the rand parameter.

Recommendations For Orange AirBox Y858 FL 01.16 04, as a temporary workaround, consider restricting access to the goform/getWlanClientInfo endpoint to minimize the risk of exploitation. Avoid using the rand parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-18376

Produtos afetados

Orange Airbox

Referências · 3

• 🔥 https://github.com/remix30303/AirboxLeak · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18376 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18376 · Aviso do Fabricante