CVE-2018-9162
CRITICALContec-touch Smart Home Firmware - Missing Authentication
Title source: ruleDescription
Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php, delete_user.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors.
Exploits (1)
Scores
CVSS v3
9.8
EPSS
0.0278
EPSS Percentile
86.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-306
Status
published
Products (1)
contec-touch/smart_home_firmware
4.15
Published
Mar 31, 2018
Tracked Since
Feb 18, 2026