PT-2018-14422 · Orange · Orange Airbox

Syrex1013 · Published 2018-10-16 · Updated 2019-10-03 · CVE-2018-18375

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orange AirBox Y858 FL 01.16 04

Description The issue allows attackers to extract APN data, including name, number, username, and password, via the rand parameter in the "goform/getProfileList" API endpoint.

Recommendations For Orange AirBox Y858 FL 01.16 04, as a temporary workaround, consider restricting access to the "goform/getProfileList" API endpoint until a patch is available. Avoid using the rand parameter in this endpoint to minimize the risk of exploitation.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2018-18375

Affected Products

Orange Airbox

References · 3

• 🔥 https://github.com/remix30303/AirBoxAPNLeaks · Exploit
• https://osv.dev/vulnerability/CVE-2018-18375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18375 · Security Note