PT-2017-17156 · Iball · Iball Baton 150M

Published 2017-03-09 · Updated 2021-06-17 · CVE-2017-6558

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iball Baton 150M iB-WRA150N version 1.2.6

Description The issue allows remote attackers to bypass authentication and view or modify administrative router settings. This is achieved by reading the HTML source code of the password.cgi file.

Recommendations For version 1.2.6, consider restricting access to the password.cgi file as a temporary workaround until a patch is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-6558

Affected Products

Iball Baton 150M

References · 6

• 🔥 https://github.com/GemGeorge/iBall-UTStar-CVEChecker · Exploit
• 🔥 https://exploit-db.com/exploits/42591 · Exploit
• https://osv.dev/vulnerability/CVE-2017-6558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6558 · Security Note
• https://youtube.com/watch?v=8GZg1IuSfCs · Note
• http://securityfocus.com/bid/96822 · Note