PT-2018-15351 · Skyworth · Skyworth Cm5100.G2+4

Capitan Alfalo · Published 2018-12-23 · Updated 2019-10-03 · CVE-2018-20398

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Skyworth CM5100 version 1.1.0 Skyworth CM5100-440 version 1.2.1 Skyworth CM5100-511 version 4.1.0.14 Skyworth CM5100-GHD00 version 1.2.2 Skyworth CM5100.g2 version 4.1.0.17

Description The issue allows remote attackers to discover credentials via specific SNMP requests, including iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0.

Recommendations For Skyworth CM5100 version 1.1.0, update the device to a newer version that contains a fix for this issue. For Skyworth CM5100-440 version 1.2.1, update the device to a newer version that contains a fix for this issue. For Skyworth CM5100-511 version 4.1.0.14, update the device to a newer version that contains a fix for this issue. For Skyworth CM5100-GHD00 version 1.2.2, update the device to a newer version that contains a fix for this issue. For Skyworth CM5100.g2 version 4.1.0.17, update the device to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the SNMP service until a patch is available.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-20398

Affected Products

Skyworth Cm5100

Skyworth Cm5100-440

Skyworth Cm5100-511

Skyworth Cm5100-Ghd00

Skyworth Cm5100.G2

References · 4

• 🔥 https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-20398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20398 · Security Note
• https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv · Note