CVE-2017-18371
CVSS V2 High 7.5
CVSS V3 Critical 9.8
Description
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.
Overview
- CVE ID
- CVE-2017-18371
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2019-05-02T17:29:01
- Last Modified Date
- 2019-05-03T19:20:00
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:o:billion:5200w-t_firmware:7.3.8.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:billion:5200w-t:-:*:*:*:*:*:*:* | 0 | OR | ||
| AND | ||||
| cpe:2.3:o:zyxel:p660hn-t1a_v2_firmware:7.3.37.6:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:zyxel:p660hn-t1a_v2:-:*:*:*:*:*:*:* | 0 | OR | ||
| AND | ||||
| cpe:2.3:o:zyxel:p660hn-t1a_v1_firmware:7.3.37.6:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:zyxel:p660hn-t1a_v1:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 7.5
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/ | Technical Description Third Party Advisory |
| https://ssd-disclosure.com/index.php/archives/2910 | Exploit Technical Description Third Party Advisory |
| https://seclists.org/fulldisclosure/2017/Jan/40 | Mailing List Exploit Third Party Advisory |
| https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt | Exploit Third Party Advisory |
| http://www.zyxel.com/support/announcement_unauthenticated.shtml | Broken Link |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2017-18371 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18371 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:53:41 | Added to TrackCVE | |||
| 2022-12-03 20:18:27 | 2019-05-02T17:29Z | 2019-05-02T17:29:01 | CVE Published Date | updated |
| 2022-12-03 20:18:27 | 2019-05-03T19:20:00 | CVE Modified Date | updated | |
| 2022-12-03 20:18:27 | Analyzed | Vulnerability Status | updated |