Remote Credential Exposure in Comtrend CM-6200un and CM-6300n Devices
CVE-2018-20388

9.8CRITICAL

Key Information:

Vendor

Comtrend

Status
Cm-6200un Firmware
Vendor
CVE Published:
23 December 2018

What is CVE-2018-20388?

The Comtrend CM-6200un and CM-6300n devices are susceptible to a vulnerability that permits remote attackers to extract user credentials. This exposure is facilitated through specific SNMP requests targeting certain OIDs, which can reveal sensitive information without the need for authentication. As a result, unauthorized access to sensitive data poses a significant risk to users and networks utilizing these devices.

References

https://github.com/ezelf/sensitivesOids/blob/master/oidpa...
x_refsource_MISC
https://misteralfa-hack.blogspot.com/2018/12/stringbleed-...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.