Orange AirBox Y858 – Unauthenticated WLAN Client Information Disclosure

Disclosure Status

disclosed

April 09, 2026

April 09, 2026

Description

Finding

Identified by Adrian Dacka via analysis of the goform/getWlanClientInfo endpoint in Orange AirBox firmware; this endpoint leaked client connection data.

Reproducibility

Query the goform/getWlanClientInfo endpoint on Orange AirBox Y858_FL_01.16_04 to obtain hostnames/IP/MAC/time for connected devices.

Impact

High-severity information disclosure (CVSS 7.5). Attackers can remotely retrieve details about clients on the Wi-Fi network.

Patches

No patch/version guidance included in the API; check vendor firmware updates.

Workarounds

Block external access to the router web interface; restrict local LAN access.

References

https://github.com/remix30303/AirboxLeak

Details

CVE-2018-18376

Orange AirBox Y858_FL_01.16_04

Adrian "syrex1013" Dacka