PT-2020-12046 · Technicolor · Technicolor Tc7337

Published 2020-03-11 · Updated 2020-03-17 · CVE-2020-10376

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Technicolor TC7337NET version 08.89.17.23.03

Description The issue allows remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header. This can be done by intercepting the Authorization header in HTTP requests, which contains the username and password in plain text.

Recommendations For Technicolor TC7337NET version 08.89.17.23.03, consider disabling the use of Basic HTTP authentication until a patch is available. Restrict access to sensitive areas of the network to minimize the risk of exploitation. Avoid using the Authorization: Basic header in HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-10376

Affected Products

Technicolor Tc7337

References · 5

• 🔥 https://medium.com/@felipeagromao/remote-control-cve-2020-10376-fed7b6b934e3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10376 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10376 · Vendor Advisory
• https://medium.com/%40felipeagromao/remote-control-cve-2020-10376-fed7b6b934e3 · Note
• https://t.me/cvenotify/1509 · Telegram Post