CVE-2018-12455 Auth bypass in n/a
Attackers can bypass authentication on Intelbras NPLUG wireless repeaters by setting a specific cookie, gaining unauthorized access to the web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12455?
CVE-2018-12455 is a high-severity authentication bypass vulnerability in n/a, published on 10 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie.
Weakness: CWE-287
Which versions are affected by CVE-2018-12455?
It affects 1 product.
Products include Intelbras Nplug Firmware.
How do I fix CVE-2018-12455?
No fix has been published for CVE-2018-12455 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-12455 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-12455 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jq56-qcgv-3phx.