PT-2018-10798 · Nec · Nec Univerge Sv9100 Webpro

Hyp3Rlinx · Published 2018-12-26 · Updated 2021-09-13 · CVE-2018-11741

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NEC Univerge Sv9100 WebPro version 6.00.00

Description The issue concerns Predictable Session IDs, which can lead to Account Information Disclosure. This occurs via specific URIs, such as 'Home.htm?sessionId=#####&GOTO(8)'.

Recommendations For NEC Univerge Sv9100 WebPro version 6.00.00, consider restricting access to the 'Home.htm' endpoint until a fix is available, and avoid using predictable session IDs to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-11741

Affected Products

Nec Univerge Sv9100 Webpro

References · 7

• 🔥 https://exploit-db.com/exploits/45942 · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Dec/1 · Exploit
• https://osv.dev/vulnerability/CVE-2018-11741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11741 · Security Note
• https://t.me/cvenotify/20734 · Telegram Post