PT-2024-20037 · Ubee · Ubee Ddw366+1

Edward Warren · Published 2024-01-20 · Updated 2024-01-29 · CVE-2024-23726

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ubee DDW365 XCNDDW365 devices (affected versions not specified) Ubee DDW366 XCNDXW3WB devices (affected versions not specified)

Description The issue concerns Ubee devices having predictable default WPA2 PSKs, which could lead to unauthorized remote access. A remote attacker in proximity to a Wi-Fi network can derive the default WPA2-PSK value by observing a beacon frame. The PSK is generated using the first six characters of the SSID and the last six of the BSSID, decrementing the last digit.

Recommendations For Ubee DDW365 XCNDDW365 devices, consider changing the default WPA2 PSK to a unique and strong password to prevent unauthorized access. For Ubee DDW366 XCNDXW3WB devices, consider changing the default WPA2 PSK to a unique and strong password to prevent unauthorized access. As a temporary workaround, restrict access to the Wi-Fi network to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-23726

Affected Products

Ubee Ddw365

Ubee Ddw366

References · 8

• 🔥 https://github.com/actuator/cve/blob/main/Ubee/CWE-1392.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-23726 · Security Note
• https://twitter.com/CVEnew/status/1748923037414572045 · Twitter Post
• https://t.me/cvenotify/68477 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1748956994910724522 · Twitter Post
• https://t.me/cvenotify/68159 · Telegram Post
• https://t.me/cvenotify/69074 · Telegram Post
• https://t.me/cvenotify/68203 · Telegram Post