CVE-2018-10252

Severity Score

8.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its current time of day in responses, it is possible to step backward through possible session values until a working one is found. Once a working session ID is found, an attacker then has admin control of the device and can add a secondary SSID to create a backdoor to the network.

Se ha descubierto un problema en dispositivos Actiontec WCB6200Q anteriores a 1.1.10.20a. La cookie de sesión de inicio de sesión de administrador se genera de manera no segura haciendo que sea posible secuestrar la sesión de administrador. Cuando un administrador inicia sesión, se genera una cookie de sesión que marca la hora del día con una sensibilidad de 10 milisegundos. Dado que el servidor web devuelve su hora actual en las respuestas, es posible probar posibles valores de sesión hasta que se encuentre uno que funcione. Cuando se encuentre un ID de sesión válido, un atacante podría entonces obtener control de administración del dispositivo y añadir un SSID secundario para crear una puerta trasera de la red.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-04-20 CVE Reserved
2018-05-14 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-384: Session Fixation

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://actiontecsupport.zendesk.com/hc/en-us/articles/115000432163-WCB6200Q-Firmware-Upgrade	2018-06-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Actiontec Search vendor "Actiontec"	Wcb6200q Firmware Search vendor "Actiontec" for product "Wcb6200q Firmware"	< 1.1.10.20a Search vendor "Actiontec" for product "Wcb6200q Firmware" and version " < 1.1.10.20a"	-	Affected	in	Actiontec Search vendor "Actiontec"	Wcb6200q Search vendor "Actiontec" for product "Wcb6200q"	-	-	Safe