PT-2018-18615 · Nucom · Nucom Wr644Gacv

Hernán Moller · Published 2018-06-25 · Updated 2019-10-03 · CVE-2018-8755

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NuCom WR644GACV devices before STA006

Description The issue allows an attacker to download the configuration file without credentials. By doing so, an attacker can access the admin password, WPA key, and any configuration information of the device.

Recommendations For NuCom WR644GACV devices before STA006, update to STA006 or later to resolve the issue. As a temporary workaround, consider restricting access to the device's configuration file until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2018-8755

Affected Products

Nucom Wr644Gacv

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-8755 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8755 · Vendor Advisory
• https://blog.nivel4.com/investigaciones/vulnerabilidad-en-los-dispositivos-nucom-wr644gacv · Note