critical9.8Public exploit code
CVE-2018-11742
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage2018-12-04 · webapps · hardware
Impact
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nec | Univerge Sv9100 Webpro Firmware | Version 6.00.00 |
Weakness classification
References
- NVD record
- CVE.org record
- http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
- http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html
- http://seclists.org/fulldisclosure/2018/Dec/1
- https://www.exploit-db.com/exploits/45942/
- http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
- http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html
- http://seclists.org/fulldisclosure/2018/Dec/1
- https://www.exploit-db.com/exploits/45942/