CVE-2017-18371

The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service…

published May 2, 2019

CVSS
—
EPSS
23%
Percentile
97.7
In the wild
Unconfirmed
What it is

⚠️ Default passwords are a ticking time bomb! This ZyXEL router has three accounts with hardcoded credentials just waiting to be exploited — it’s like leaving your front door wide open and inviting trouble in. 🌪️ Think of these hardcoded accounts like a hotel room with a master key that anyone can use. Instead of just one untrustworthy guest accessing it, multiple people have the key, opening up a world of mischief. An attacker could waltz into your router settings, change configurations, and potentially compromise your entire network. They could redirect traffic, block connections, or even use your router for malicious purposes without you ever knowing. That's absolutely devastating!

Put simply

Think of these hardcoded accounts like a hotel room with a master key that anyone can use. Instead of just one untrustworthy guest accessing it, multiple people have the key, opening up a world of mischief. This vulnerability in the ZyXEL P660HN-T1A router allows an attacker to log in using default credentials and exploit authenticated command injections, altering sensitive router settings directly.

What to do

An attacker could waltz into your router settings, change configurations, and potentially compromise your entire network. They could redirect traffic, block connections, or even use your router for malicious purposes without you ever knowing. That's absolutely devastating! Change the default usernames and passwords immediately! Ensure that all accounts are secured with strong, unique passwords. Consider disabling or restricting access to any unnecessary service accounts to minimize exposure. You've got this! Follow these simple steps, and your network will be fortified against unwanted guests in no time! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.22531 · 97.7th percentile
Published
2019-05-02T16:15Z
EPSS history
Timeline
  • 02 MAY 16:15Z
    The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service…
    cvelistv5