CVE-2018-12048 - A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device

Back Back to CVE browser

CRITICAL

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device

Published Jun 8, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 5.12%

Description

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://gist.github.com/huykha/455e7d3b86eb6629066d921f46bfcee3
x_refsource_MISCBroken LinkThird Party Advisory
https://www.exploit-db.com/exploits/44885/
exploitx_refsource_EXPLOIT-DBBroken LinkThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://gist.github.com/huykha/455e7d3b86eb6629066d921f46bfcee3		x_refsource_MISCBroken LinkThird Party Advisory
https://www.exploit-db.com/exploits/44885/		exploitx_refsource_EXPLOIT-DBBroken LinkThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 8, 2018

Updated Aug 5, 2024

Reserved Jun 7, 2018

Link CVE-2018-12048

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-12048

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-12048