CVE-2018-6312

A privileged account with a weak default password on the Foxconn femtocell FEMTO AP-FC4064-T version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 can be used to turn on the TELNET service via the web interface, which allows root login without any password. This vulnerability will lead to full system compromise and disclosure of user communications. The foxconn account with an 8-character lowercase alphabetic password can be used.

CVSS v3 7.2 HIGH
CVSS v2.0 9.0 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://gist.github.com/DrmnSamoLiu/cd1d6fa59501f161616686296aa4a6c8	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:foxconn:ap-fc4064-t_firmware:ap_gt_b38_5.8.3lb15-w47_lte:*:*:*:*:*:*:*

cpe:2.3:h:foxconn:ap-fc4064-t:-:*:*:*:*:*:*:*

History

09 Sep 2021, 13:35

Type	Values Removed	Values Added
CPE	cpe:2.3:o:foxconn:femtocell_femto_ap-fc4064-t_firmware:ap_gt_b38_5.8.3lb15-w47_lte:::::::* cpe:2.3:h:foxconn:femtocell_femto_ap-fc4064-t:-:::::::*	cpe:2.3:h:foxconn:ap-fc4064-t:-:::::::* cpe:2.3:o:foxconn:ap-fc4064-t_firmware:ap_gt_b38_5.8.3lb15-w47_lte:::::::*

Information

Published : 2018-03-10 22:29

Updated : 2023-12-10 12:30

NVD link : CVE-2018-6312

Mitre link : CVE-2018-6312

CVE.ORG link : CVE-2018-6312

JSON object : View

Products Affected

foxconn

ap-fc4064-t_firmware
ap-fc4064-t

CWE

CWE-521

Weak Password Requirements

{"id": "CVE-2018-6312", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2018-03-10T22:29:00.350", "references": [{"url": "https://gist.github.com/DrmnSamoLiu/cd1d6fa59501f161616686296aa4a6c8", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "A privileged account with a weak default password on the Foxconn femtocell FEMTO AP-FC4064-T version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 can be used to turn on the TELNET service via the web interface, which allows root login without any password. This vulnerability will lead to full system compromise and disclosure of user communications. The foxconn account with an 8-character lowercase alphabetic password can be used."}, {"lang": "es", "value": "Una cuenta privilegiada con una contrase\u00f1a d\u00e9bil por defecto en Foxconn femtocell FEMTO AP-FC4064-T, versi\u00f3n AP_GT_B38_5.8.3lb15-W47 LTE Build 15, puede emplearse para activar el servicio TELNET mediante la interfaz web. Esto permite el inicio de sesi\u00f3n como root sin contrase\u00f1a. La vulnerabilidad conducir\u00e1 al compromiso total del sistema y a la revelaci\u00f3n de comunicaciones de usuario. Se puede emplear la cuenta de foxconn con una contrase\u00f1a de 8 caracteres alfanum\u00e9ricos en min\u00fascula."}], "lastModified": "2021-09-09T13:35:06.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:foxconn:ap-fc4064-t_firmware:ap_gt_b38_5.8.3lb15-w47_lte:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1996692-932A-4397-8DB9-C55C4D362FB5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:foxconn:ap-fc4064-t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1BCB6BAB-3889-48DB-8C47-0E525338E69A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}