CVE-2018-10024

CRITICAL

ubiQuoss Switch VP5208A - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-10024. PoCs published by X-C3LL.

AI-analyzed exploit summary This PoC exploits an authentication bypass vulnerability in Ubiquoss QoS Switch devices by sending a crafted login request, which triggers the creation of a 'bcm_passwd' file containing credentials. The script then retrieves this file to expose the device's credentials.

Description

ubiQuoss Switch VP5208A creates a bcm_password file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH (or TELNET if it is enabled).

Exploits (1)

github WORKING POC 11 stars
by X-C3LL · pythonpoc
https://github.com/X-C3LL/PoC-CVEs/tree/master/CVE-2018-10024

This PoC exploits an authentication bypass vulnerability in Ubiquoss QoS Switch devices by sending a crafted login request, which triggers the creation of a 'bcm_passwd' file containing credentials. The script then retrieves this file to expose the device's credentials.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Ubiquoss QoS Switch (specific version not specified)
No auth needed
Prerequisites: network access to the target device · HTTP access to the login endpoint
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.tarlogic.com/advisories/Tarlogic-2018-002.txt

Scores

CVSS v3 9.8
EPSS 0.0143
EPSS Percentile 69.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-522
Status published
Products (1)
ubiquoss/vp5208a_firmware
Published Apr 11, 2018
Tracked Since Feb 18, 2026