PT-2018-11233 · Telesquare · Sdt-Cw3B1+1

Published 2018-06-21 · Updated 2018-08-14 · CVE-2018-12526

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Telesquare SDT-CS3B1 and SDT-CW3B1 devices versions prior to 1.2.0 Telesquare SDT-CS3B1 and SDT-CW3B1 devices version 1.2.0

Description The issue concerns a default factory account in the devices. Remote attackers can obtain access to the device via TELNET using a hardcoded account.

Recommendations For Telesquare SDT-CS3B1 and SDT-CW3B1 devices versions prior to 1.2.0, update to a version later than 1.2.0 to remove the default factory account. For Telesquare SDT-CS3B1 and SDT-CW3B1 devices version 1.2.0, update to a version later than 1.2.0 to remove the default factory account. As a temporary workaround, consider disabling TELNET access to the device until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-12526

Affected Products

Sdt-Cs3B1

Sdt-Cw3B1

References · 4

• https://osv.dev/vulnerability/CVE-2018-12526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12526 · Security Note
• https://fortiguard.com/zeroday/FG-VD-18-106 · Note
• https://boho.or.kr/data/secNoticeView.do?bulletin_writing_sequence=27284 · Note