CVE-2018-10578
CRITICALWatchGuard AP100-AP200/AP300 <1.2.9.15/<2.0.0.10 - Auth Bypass
Title source: llmDescription
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect validation of the "old password" field in the change password form allows an attacker to bypass validation of this field.
References (1)
Core 1
Core References
Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2018/May/12
Scores
CVSS v3
9.8
EPSS
0.0130
EPSS Percentile
67.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (4)
watchguard/ap100_firmware
< 1.2.9.15
watchguard/ap102_firmware
< 1.2.9.15
watchguard/ap200_firmware
< 1.2.9.15
watchguard/ap300_firmware
< 2.0.0.10
Published
May 02, 2018
Tracked Since
Feb 18, 2026