Sign-up

ID

VAR-201905-0656


CVE

CVE-2017-18373


TITLE

Billion 5200W-T Vulnerabilities related to the use of hard-coded credentials

Trust: 0.8

sources: JVNDB: JVNDB-2017-014434

DESCRIPTION

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username user3 and and a long password consisting of a repetition of the string 0123456789. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes. Billion 5200W-T Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Billion Electric 5200W-T is a wireless router produced by British company Billion Electric. A trust management issue vulnerability exists in the Billion 5200W-T using firmware version 7.3.8.0. This vulnerability stems from the lack of an effective trust management mechanism in network systems or products. Attackers can use default passwords or hard-coded passwords, hard-coded certificates, etc. to attack affected components

Trust: 1.71

sources: NVD: CVE-2017-18373 // JVNDB: JVNDB-2017-014434 // VULHUB: VHN-109489

AFFECTED PRODUCTS

vendor:billionmodel:5200w-tscope:eqversion:7.3.8.0

Trust: 1.0

vendor:billionmodel:5200w-tscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2017-014434 // NVD: CVE-2017-18373

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-18373
value: HIGH

Trust: 1.0

NVD: CVE-2017-18373
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201905-078
value: HIGH

Trust: 0.6

VULHUB: VHN-109489
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-18373
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-109489
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-18373
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-109489 // JVNDB: JVNDB-2017-014434 // CNNVD: CNNVD-201905-078 // NVD: CVE-2017-18373

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.9

sources: VULHUB: VHN-109489 // JVNDB: JVNDB-2017-014434 // NVD: CVE-2017-18373

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-078

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201905-078

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014434

PATCH
title:Top Pageurl:http://www.billion.com.tw/index.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-014434

EXTERNAL IDS
db:NVDid:CVE-2017-18373
Trust: 2.5
db:JVNDBid:JVNDB-2017-014434
Trust: 0.8
db:CNNVDid:CNNVD-201905-078
Trust: 0.7
db:VULHUBid:VHN-109489
Trust: 0.1
sources:
            
            
            VULHUB: VHN-109489 // 
            
            
            
            JVNDB: JVNDB-2017-014434 // 
            
            
            
            CNNVD: CNNVD-201905-078 // 
            
            
            
            NVD: CVE-2017-18373

REFERENCES
url:https://seclists.org/fulldisclosure/2017/jan/40
Trust: 2.5
url:https://raw.githubusercontent.com/pedrib/poc/master/advisories/zyxel_trueonline.txt
Trust: 1.7
url:https://ssd-disclosure.com/index.php/archives/2910
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2017-18373
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18373
Trust: 0.8
sources:
            
            
            VULHUB: VHN-109489 // 
            
            
            
            JVNDB: JVNDB-2017-014434 // 
            
            
            
            CNNVD: CNNVD-201905-078 // 
            
            
            
            NVD: CVE-2017-18373

SOURCES
db:VULHUBid:VHN-109489
db:JVNDBid:JVNDB-2017-014434
db:CNNVDid:CNNVD-201905-078
db:NVDid:CVE-2017-18373

LAST UPDATE DATE
2024-11-23T23:01:50.385000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-109489date:2019-05-03T00:00:00
db:JVNDBid:JVNDB-2017-014434date:2019-05-23T00:00:00
db:CNNVDid:CNNVD-201905-078date:2019-05-08T00:00:00
db:NVDid:CVE-2017-18373date:2024-11-21T03:19:57.680

SOURCES RELEASE DATE
db:VULHUBid:VHN-109489date:2019-05-02T00:00:00
db:JVNDBid:JVNDB-2017-014434date:2019-05-23T00:00:00
db:CNNVDid:CNNVD-201905-078date:2019-05-02T00:00:00
db:NVDid:CVE-2017-18373date:2019-05-02T17:29:01.363