CVE Daily

CVE-2018-18871

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP...

Critical CVSS 9.8

Overview

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).

CWE: CWE-640 Published: 2018-12-20T21:29:00.823
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.8 (CRITICAL)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags