Remote Credential Discovery in Thomson Networking Devices
CVE-2018-20394

9.8CRITICAL

Key Information:

Vendor

Technicolor

Status
Dwg849 Firmware
Vendor
CVE Published:
23 December 2018

What is CVE-2018-20394?

Thomson networking devices have a vulnerability that allows remote attackers to exploit specific SNMP requests to discover sensitive credentials. By targeting the object identifiers iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0, attackers can gain unauthorized access to critical account information, potentially compromising network security. This issue emphasizes the need for organizations using affected devices to review their security measures and apply necessary protections.

References

https://github.com/ezelf/sensitivesOids/blob/master/oidpa...
x_refsource_MISC
https://misteralfa-hack.blogspot.com/2018/12/stringbleed-...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.