PT-2018-16849 · Cobham · Cobham Sea Tel 121

Capitan Alfalo · Published 2018-01-08 · Updated 2018-02-01 · CVE-2018-5266

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cobham Sea Tel 121 build 222701

Description The issue allows remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the "js/userLogin.js" URI. Default passwords for standard usernames are listed in the product's documentation, including Dealer with password seatel3, SysAdmin with password seatel2, and User with password seatel1.

Recommendations For Cobham Sea Tel 121 build 222701, consider changing the default passwords for the standard usernames to strong, unique passwords to minimize the risk of exploitation. As a temporary workaround, restrict access to the "js/userLogin.js" URI to prevent unauthorized users from reading sensitive information.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-5266

Affected Products

Cobham Sea Tel 121

References · 3

• 🔥 http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-terminales-satelitales.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-5266 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5266 · Vendor Advisory