CVE-2018-17558 Hardcoded credentials in n/a

Critical 9.8 Published 26 Oct 2023 Updated 11 Sep 2024

Hardcoded credentials and command injection in ABUS IP cameras allow remote attackers to execute code as root.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-17558?

CVE-2018-17558 is a critical vulnerability in n/a, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.

Weakness: CWE-798, CWE-78

Which versions are affected by CVE-2018-17558?

It affects 47 products.

Products include Abus Tvip 10000 Firmware, Abus Tvip 10001 Firmware, Abus Tvip 10005 Firmware, Abus Tvip 10005a Firmware, Abus Tvip 10005b Firmware, Abus Tvip 10050 Firmware and 41 more.

How do I fix CVE-2018-17558?

No fix has been published for CVE-2018-17558 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-17558 being exploited?

There is no known exploitation of CVE-2018-17558 in the wild and no public exploit code.

Sources

Also known as GHSA-fj49-xvp9-p96q.