6.5med
CVE-2018-4059
An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known
Summary
An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.
Exploit prediction (EPSS)
1.90% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Talos coTURN
Classification
- Weakness
- CWE-862 Missing Authorization
References
- talosintelligence.com /vulnerability_reports/TALOS-2018-0733 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-4059
- NVD: CVE-2018-4059
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.