CVE-2018-10024

Published: Apr 11, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

ubiQuoss Switch VP5208A creates a bcm_password file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH (or TELNET if it is enabled).

Affected (1)

Products: Ubiquoss: Vp5208a Firmware

1 product

Vp5208a Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ubiquoss Vp5208a Firmware	All versions

Running on/with	Platform Versions
Ubiquoss Vp5208a	All versions

Related CWEs

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://www.tarlogic.com/advisories/Tarlogic-2018-002.txt

Source: cve@mitre.org

Third Party Advisory

https://www.tarlogic.com/advisories/Tarlogic-2018-002.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.