CVE-2018-16705

Published: Sep 10, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext.

Affected (2)

Products: Furuno: Felcom 250 Firmware, Felcom 500 Firmware

2 products

Felcom 250 Firmware

Felcom 500 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furuno Felcom 250 Firmware	All versions

Running on/with	Platform Versions
Furuno Felcom 250	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Furuno Felcom 500 Firmware	All versions

Running on/with	Platform Versions
Furuno Felcom 500	All versions

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://cyberskr.com/blog/furuno-felcom.html

Source: cve@mitre.org

ExploitTechnical DescriptionThird Party Advisory

https://gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31

Source: cve@mitre.org

Third Party Advisory

https://cyberskr.com/blog/furuno-felcom.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitTechnical DescriptionThird Party Advisory

https://gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.