CVE-2018-13862 — CRITICAL (9.8)

Vulnerability Description

Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using the GET request "?id=0&attr=protectAccess&newValue=0" (a successful attack will allow attackers to login without authorization).

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Trivum	Webtouch Setup V9 Firmware	2.53
Trivum	Webtouch Setup V9	-

References

http://update.trivum.com/update/tp9-changes.htmlVendor Advisory
https://vulncode.com/advisory/CVE-2018-13862Third Party Advisory
https://www.exploit-db.com/exploits/45063/ExploitThird Party AdvisoryVDB Entry
http://update.trivum.com/update/tp9-changes.htmlVendor Advisory
https://vulncode.com/advisory/CVE-2018-13862Third Party Advisory
https://www.exploit-db.com/exploits/45063/ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2018-13862?

CVE-2018-13862 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using ...

How severe is CVE-2018-13862?

CVE-2018-13862 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-13862?

Check the references section above for vendor advisories and patch information. Affected products include: Trivum Webtouch Setup V9 Firmware, Trivum Webtouch Setup V9.