CVE-2018-6387 Hardcoded credentials in n/a

Critical 9.8 Published 29 Jan 2018 Updated 16 Sep 2024

Attackers can gain administrative access to iBall routers using hardcoded default passwords for admin, support, and user accounts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-6387?

CVE-2018-6387 is a critical vulnerability in n/a, published on 29 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of support for the support account, and a hardcoded password of user for the user account.

Weakness: CWE-798

Which versions are affected by CVE-2018-6387?

It affects 1 product.

Products include Iball Ib-Wra150n Firmware.

How do I fix CVE-2018-6387?

No fix has been published for CVE-2018-6387 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-6387 being exploited?

There is no known exploitation of CVE-2018-6387 in the wild and no public exploit code.

Sources

Also known as GHSA-376h-xh6m-wfrm.