PT-2019-9965 · Iball · Iball Baton Ib-Wrb302N

Published 2019-05-28 · Updated 2021-06-21 · CVE-2018-20008

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iBall Baton iB-WRB302N version 20122017

Description The issue concerns improper access control over the UART interface, allowing physical attackers to access sensitive information. This includes discovering Wi-Fi credentials in plain text and the web-console password in base64 via the debugging console.

Recommendations For iBall Baton iB-WRB302N version 20122017, as a temporary workaround, consider restricting physical access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-732

CWE-312

Related Identifiers

CVE-2018-20008

Affected Products

Iball Baton Ib-Wrb302N

References · 4

• 🔥 https://payatu.com/ibaton-routers-responsible-disclosure · Exploit
• https://osv.dev/vulnerability/CVE-2018-20008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20008 · Security Note
• https://iball.co.in/Category/Baton/283 · Vendor Advisory