CRITICAL🇵🇱 Wersja polska

CVE-2018-20512

CVSS 9.8v3.0pub. 2019-01-03upd. 2024-11-21

EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cdatatec Epon Cpe Wifi Devices Firmware

    OS
    Cdatatec
    2.0.4-x000

  • Cdatatec Fd108bn

    HW
    Cdatatec
    all versions

  • Cdatatec Fd111hz

    HW
    Cdatatec
    all versions

  • Cdatatec Fd111y

    HW
    Cdatatec
    all versions

  • Cdatatec Fd114y

    HW
    Cdatatec
    all versions

  • Cdatatec Fd212gw

    HW
    Cdatatec
    all versions

  • Cdatatec Fd212h

    HW
    Cdatatec
    all versions

  • Cdatatec Fd214gh

    HW
    Cdatatec
    all versions

  • Cdatatec Fd214gw

    HW
    Cdatatec
    all versions

  • Cdatatec Fd404gh

    HW
    Cdatatec
    all versions

  • Cdatatec Fd404gw

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 104

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 104g

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 108f Hz500

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 111g

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 111gw

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 301

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 301gw

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 304

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 304ga Hr500

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 304ga Hr511

    HW
    Cdatatec
    all versions

  • Cdatatec Fd600 521g

    HW
    Cdatatec
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-29337CRITICAL9.8PL ✓same vendor

Command injection w C-DATA FD702XW-X-R430 via parametr va_cmd

CVE-2020-29056CRITICAL9.8PL ✓same vendor

Eskalacja uprawnień do root w urządzeniach CDATA OLT przez TFTP

CVE-2020-29054CRITICAL9.8PL ✓same vendor

CDATA OLT – ujawnienie poświadczeń TELNET w postaci jawnej

CVE-2020-29058CRITICAL9.8PL ✓same vendor

CDATA OLT — ujawnienie danych uwierzytelniających serwera WWW w postaci jawnej

CVE-2020-29059CRITICAL9.8PL ✓same vendor

Domyślne hasło w urządzeniach CDATA OLT — nieautoryzowany dostęp