PT-2019-18739 · Jio · Jiofi 4

Published 2019-05-07 · Updated 2020-08-24 · CVE-2019-7745

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07

Description The issue allows remote attackers to obtain the Wi-Fi password by making a "cgi-bin/qcmap web cgi Page=GetWiFi Setting" request and then reading the wpa security key field.

Recommendations For JioFi 4 jmr1140 Amtel JMR1140 R12.07, as a temporary workaround, consider restricting access to the "cgi-bin/qcmap web cgi" endpoint until a patch is available. Avoid using the wpa security key field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-7745

Affected Products

Jiofi 4

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-7745 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7745 · Vendor Advisory
• https://exploit-db.com/exploits/46364 · Note
• http://packetstormsecurity.com/files/151655/Jiofi-4-JMR-1140-WiFi-Password-Cross-Site-Request-Forgery.html · Note
• https://jiosecuritybugs.blogspot.com/2019/02/cve-2019-7745-jiofi-4-jmr1140.html · Note