PT-2018-1331 · Intelbras · Intelbras Ncloud 300

Pedro Aguiar · Published 2018-05-09 · Updated 2018-06-22 · CVE-2018-11094

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intelbras NCLOUD 300 version 1.0

Description The issue is related to the use of predefined registration data in the ExportSettings.sh, updateWPS, RebootSystem, and vpnBasicSettings components of the Intelbras NCLOUD 300 Wi-Fi router's firmware. An attacker can exploit this to disclose protected information and gain access to the device with administrator privileges. The API endpoints "cgi-bin/ExportSettings.sh", "goform/updateWPS", "goform/RebootSystem", and "goform/vpnBasicSettings" do not require authentication, allowing an attacker to retrieve sensitive information, such as username and password, by making an HTTP POST request to these endpoints.

Recommendations For version 1.0, consider disabling access to the "cgi-bin/ExportSettings.sh", "goform/updateWPS", "goform/RebootSystem", and "goform/vpnBasicSettings" API endpoints until a patch is available to require authentication for these endpoints. Restrict access to these components to minimize the risk of exploitation. Avoid using these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2018-00829

CVE-2018-11094

Affected Products

Intelbras Ncloud 300

References · 5

• 🔥 https://blog.kos-lab.com/Hello-World · Exploit
• 🔥 https://exploit-db.com/exploits/44637 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11094 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11094 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00829 · Security Note