PT-2018-12325 · Hewlett Packard · Wi2Be Smart Hp Wmt

Vulnc0D3 · Published 2018-08-20 · Updated 2020-08-24 · CVE-2018-14077

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wi2be SMART HP WMT version 1.2.20 201400922

Description The issue allows unauthorized remote attackers to backup the device configuration. This is achieved by sending a direct request to the "/Maintenance/configfile.cfg" API endpoint.

Recommendations For version 1.2.20 201400922, consider restricting access to the "/Maintenance/configfile.cfg" API endpoint to prevent unauthorized configuration backups until a patch is available.

Fix

Related Identifiers

CVE-2018-14077

Affected Products

Wi2Be Smart Hp Wmt

References · 3

• https://osv.dev/vulnerability/CVE-2018-14077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14077 · Security Note
• https://vulncode.com/advisory/CVE-2018-14077 · Note