CVE-2018-16705 Information disclosure in n/a
Unauthenticated attackers can access XML files exposing system usernames, unsalted MD5 password hashes, and cleartext SMS passwords on FURUNO FELCOM devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16705?
CVE-2018-16705 is a critical vulnerability in n/a, published on 10 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext.
Weakness: CWE-200
Which versions are affected by CVE-2018-16705?
It affects 2 products.
Products include Furuno Felcom 250 Firmware, Furuno Felcom 500 Firmware.
How do I fix CVE-2018-16705?
No fix has been published for CVE-2018-16705 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-16705 being exploited?
There is no known exploitation of CVE-2018-16705 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jgrg-hjm6-wj6m.