PT-2019-9123 · Telus · Telus Actiontec Web6000Q

Andrew Klaus · Publicado 2019-06-11 · Atualizado 2020-08-24 · CVE-2018-15555

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telus Actiontec WEB6000Q version 1.1.02.22

Description The issue allows an attacker to gain root level access on the device using the username "root" and password "admin" through the enabled onboard UART headers. This provides an attacker with elevated privileges, potentially leading to further exploitation.

Recommendations For Telus Actiontec WEB6000Q version 1.1.02.22, consider disabling the onboard UART headers to prevent unauthorized access until a patch is available. Additionally, changing the default password for the "root" user can help mitigate the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-662

Identificadores relacionados

CVE-2018-15555

Produtos afetados

Telus Actiontec Web6000Q

Referências · 6

• https://t.me/defcon_news/16064 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-15555 · Aviso do Fabricante
• http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html · Nota
• http://seclists.org/fulldisclosure/2019/Jun/1 · Nota
• https://t.me/cibsecurity/5205 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-15555 · Nota de Segurança