CVE-2018-12455

HIGHNuclei

Intelbras NPLUG 1.0.0.14 - Authentication Bypass

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-12455 has a selected CVSS score of 8.1 (high); EIP currently links 1 Nuclei template.

Description

Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALIntelbras NPLUG 1.0.0.14 - Authentication BypassCVSS 8.1

Intelbras NPLUG 1.0.0.14 is vulnerable to authentication bypass through cookie manipulation. An attacker can bypass authentication by simply setting a cookie named "admin:".

Impact

Unauthenticated attackers can bypass authentication and download the router configuration file containing credentials, network settings, and sensitive information.

Remediation

Update the device firmware to the latest version.

WeaknessesCWE-287
Authorsritikchaddha
Template tagscvecve2018intelbrasauth-bypassiotvuln
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:h:intelbras:nplug:-:*:*:*:*:*:*:*
Shodan: html:"NPLUG"
FOFA: title="NPLUG"
https://seclists.org/fulldisclosure/2018/Oct/18 https://nvd.nist.gov/vuln/detail/CVE-2018-12455

Source: ProjectDiscovery

References

2