PT-2018-14423 · Orange · Orange Airbox

Published 2018-10-16 · Updated 2018-12-06 · CVE-2018-18376

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Orange AirBox Y858 FL 01.16 04

Description The issue allows remote attackers to discover information about currently connected devices, including hostnames, IP addresses, MAC addresses, and connection time, by exploiting the goform/getWlanClientInfo endpoint using the rand parameter.

Recommendations For Orange AirBox Y858 FL 01.16 04, as a temporary workaround, consider restricting access to the goform/getWlanClientInfo endpoint to minimize the risk of exploitation. Avoid using the rand parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-18376

Affected Products

Orange Airbox

References · 3

• 🔥 https://github.com/remix30303/AirboxLeak · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18376 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18376 · Vendor Advisory