CVE-2018-11094 - An issue was discovered on Intelbras NCLOUD 300 1.0 devices

Back Back to CVE browser

CRITICAL

An issue was discovered on Intelbras NCLOUD 300 1.0 devices

Published May 15, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 33.40%

Description

An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. For example, when an HTTP POST request is made to /cgi-bin/ExportSettings.sh, the username, password, and other details are retrieved.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

https://blog.kos-lab.com/Hello-World/
x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/44637/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://blog.kos-lab.com/Hello-World/		x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/44637/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry