PT-2019-9124 · Quantenna+1 · Quantenna Wifi Controller+1

Andrew Klaus · Publicado 2019-06-27 · Atualizado 2019-10-09 · CVE-2018-15556

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Actiontec WEB6000Q version 1.1.02.22

Description The issue allows login with root level access using the user "root" and an empty password by exploiting the enabled onboard UART headers on the Quantenna WiFi Controller.

Recommendations For version 1.1.02.22, consider disabling the UART headers to prevent unauthorized access until a patch is available. Restrict physical access to the device to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-15556

Produtos afetados

Quantenna Wifi Controller

Web6000Q

Referências · 5

• 🔥 http://seclists.org/fulldisclosure/2019/Jun/1 · Exploit
• 🔥 http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15556 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15556 · Aviso do Fabricante
• https://t.me/cibsecurity/5181 · Publicação no Telegram