PT-2018-1456 · Netcomm Wireless · Netcomm Wireless G Lte Light Industrial M2M Router

Aditya K. Sood · Published 2018-08-09 · Updated 2019-10-09 · CVE-2018-14785

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) versions 2.0.29.11 and prior

Description The issue is related to the disclosure of information through directory listing without authentication. This allows a remote attacker to gain unauthorized access to protected data by reading the device's directory files.

Recommendations For versions 2.0.29.11 and prior, consider restricting access to the device's directory to minimize the risk of exploitation. As a temporary workaround, limit remote access to the device until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

CWE-548

Related Identifiers

BDU:2018-01007

CVE-2018-14785

Affected Products

Netcomm Wireless G Lte Light Industrial M2M Router

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-14785 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14785 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01007 · Security Note
• http://securityfocus.com/bid/105053 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-221-02 · Note
• https://support.netcommwireless.com/product/nwl-25#Firmware · Note