PT-2018-10799 · Nec · Nec Univerge Sv9100 Webpro

Hyp3Rlinx · Published 2018-12-26 · Updated 2021-09-13 · CVE-2018-11742

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NEC Univerge Sv9100 WebPro version 6.00.00

Description The issue concerns cleartext password storage in the Web UI. This means that passwords are stored in a plaintext format, which can be easily accessed by unauthorized parties.

Recommendations For NEC Univerge Sv9100 WebPro version 6.00.00, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-11742

Affected Products

Nec Univerge Sv9100 Webpro

References · 7

• 🔥 https://exploit-db.com/exploits/45942 · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Dec/1 · Exploit
• https://osv.dev/vulnerability/CVE-2018-11742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11742 · Security Note
• https://t.me/cvenotify/20735 · Telegram Post