CVE-2018-20382

Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and…

published December 23, 2018

CVSS
—
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

⚠️ Remote attackers can tap into sensitive credentials through a simple SNMP request — it's like leaving your front door unlocked with a welcome mat that says, 'Help yourself!' 🔑 Think of your devices like a hotel with a concierge. If the concierge hands out room keys without checking IDs, anyone can walk in and take whatever they want. This vulnerability allows remote attackers to do just that, accessing credentials without proper verification. If exploited, an attacker could easily uncover sensitive credentials, which could lead to unauthorized access to the device and its resources. This could result in a security breach, impacting the integrity of your network and potentially exposing critical data.

Put simply

Think of your devices like a hotel with a concierge. If the concierge hands out room keys without checking IDs, anyone can walk in and take whatever they want. This vulnerability allows remote attackers to do just that, accessing credentials without proper verification. This vulnerability allows remote attackers to leverage SNMP requests to discover sensitive credentials stored within Jiuzhou BCM93383WRG devices, specifically targeting certain OIDs that reveal this information.

What to do

If exploited, an attacker could easily uncover sensitive credentials, which could lead to unauthorized access to the device and its resources. This could result in a security breach, impacting the integrity of your network and potentially exposing critical data. To mitigate this risk, ensure that SNMP access is restricted and utilize access control lists to limit who can query your devices. Additionally, consider implementing strong authentication methods and regularly monitoring your network for unusual activity. You've got this! By taking these steps, you'll be well on your way to securing your devices. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01513 · 74.3th percentile
Published
2018-12-23T21:00Z
EPSS history
Timeline
  • 23 DEC 21:00Z
    Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and…
    cvelistv5