CVE-2017-7315
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD
Description
An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin.
Affected (1)
Products: Humaxdigital: Hg100r Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.0.6 |
| Running on/with | Platform Versions |
|---|---|
Humaxdigital Hg100r | All versions |
Related CWEs
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-522
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListVDB Entry
Timeline
No history available yet.