6.8med
CVE-2018-9149
The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 40%
Public exploits
0
none known
Summary
The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor.
Exploit prediction (EPSS)
0.46% probability of exploitation in the next 30 days, higher than 40% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.8 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-798 Use of Hard-coded Credentials
References
- slideshare.net /secret/qrHwDOJ71eLg7f · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-9149
- NVD: CVE-2018-9149
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.