CVE-2017-16885

Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usage, Changing Passwords, etc.) allows remote attackers to look for the information without authenticating. The information includes Version of device, Firmware ID, Connected users to device along their MAC Addresses, etc.

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://seclists.org/fulldisclosure/2018/Jan/28	Mailing List Third Party Advisory
https://www.exploit-db.com/exploits/43460/	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2018/Jan/28	Mailing List Third Party Advisory
https://www.exploit-db.com/exploits/43460/	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:fiberhome:lm53q1_firmware:vh519r05c01s38:*:*:*:*:*:*:*

cpe:2.3:h:fiberhome:lm53q1:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:17

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2018/Jan/28 - Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2018/Jan/28 - Mailing List, Third Party Advisory
References	~~() https://www.exploit-db.com/exploits/43460/ - Exploit, Third Party Advisory, VDB Entry~~	() https://www.exploit-db.com/exploits/43460/ - Exploit, Third Party Advisory, VDB Entry

Information

Published : 2018-01-12 17:29

Updated : 2024-11-21 03:17

NVD link : CVE-2017-16885

Mitre link : CVE-2017-16885

CVE.ORG link : CVE-2017-16885

JSON object : View

Products Affected

fiberhome

lm53q1
lm53q1_firmware

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2017-16885", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-01-12T17:29:00.897", "references": [{"url": "http://seclists.org/fulldisclosure/2018/Jan/28", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/43460/", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2018/Jan/28", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/43460/", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usage, Changing Passwords, etc.) allows remote attackers to look for the information without authenticating. The information includes Version of device, Firmware ID, Connected users to device along their MAC Addresses, etc."}, {"lang": "es", "value": "La gesti\u00f3n indebida de permisos en el portal en dispositivos FiberHome LM53Q1 VH519R05C01S38 (dise\u00f1ados para obtener informaci\u00f3n sobre el uso de Internet, cambiar contrase\u00f1as, etc.) permite que atacantes remotos busquen la informaci\u00f3n sin autenticarse. Esta informaci\u00f3n incluye la versi\u00f3n del dispositivo, el ID del firmware, los usuarios que est\u00e1n conectados al dispositivo junto con sus direcciones MAC, etc."}], "lastModified": "2024-11-21T03:17:10.670", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fiberhome:lm53q1_firmware:vh519r05c01s38:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AE0B4C9-DF2A-4DB8-9925-FD2659D0D0D5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fiberhome:lm53q1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3A459B20-2F60-4CB2-BDEE-925DD450636C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}