PT-2017-18517 · Be · Be126 Wifi Repeater

Published 2017-09-20 · Updated 2017-09-28 · CVE-2017-8771

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BE126 WIFI repeater version 1.0

Description The issue allows an attacker to log into the device using default credentials as root, with the username: root and password: root, via telnet, which is open by default. The attacker can then trick a connected user into clicking a malicious link, leading to the infection of the device with malicious code.

Recommendations For BE126 WIFI repeater version 1.0, change the default credentials for the root user to prevent unauthorized access via telnet. As a temporary workaround, consider disabling telnet access until a patch is available. Restrict access to the device to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-8771

Affected Products

Be126 Wifi Repeater

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-8771 · Security Note
• http://digitalwhisper.co.il/files/Zines/0x56/DW86-1-RepeaterHack.pdf · Note