PT-2017-17659 · Humax · Humax Digital Hg100R

The Gambler · Published 2017-07-04 · Updated 2019-10-03 · CVE-2017-7315

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Humax Digital HG100R version 2.0.6

Description An issue was discovered where it is not necessary to use credentials to download the backup file. The router credentials are stored in plaintext inside the backup file, referred to as GatewaySettings.bin.

Recommendations For Humax Digital HG100R version 2.0.6, consider changing the router credentials and storing them securely to minimize the risk of exploitation. As a temporary workaround, restrict access to the backup file to prevent unauthorized downloads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Insufficiently Protected Credentials

Weakness Enumeration

CWE-306

CWE-522

Related Identifiers

CVE-2017-7315

Affected Products

Humax Digital Hg100R

References · 3

• 🔥 http://seclists.org/fulldisclosure/2017/Jun/45 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7315 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7315 · Vendor Advisory