CVE-2018-20395

NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and…

published December 23, 2018

CVSS
—
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

🚨 A little-known SNMP vulnerability lets attackers sniff out sensitive credentials like a chef smelling a delicious dish wafting from the kitchen! Think of it like a waiter who forgets to check IDs before serving wine — anyone can simply ask for that secret ingredient without any verification. This vulnerability exposes sensitive information that should be behind a locked door, yet it's all too accessible for those in the know. If exploited, an attacker could easily discover the device credentials, potentially leading to unauthorized access and control over NETWAVE devices. Imagine an unwelcome guest gaining entry to your cozy gathering, turning a fun party into a disaster!

Put simply

Think of it like a waiter who forgets to check IDs before serving wine — anyone can simply ask for that secret ingredient without any verification. This vulnerability exposes sensitive information that should be behind a locked door, yet it's all too accessible for those in the know. This vulnerability arises from allowing unauthorized SNMP requests to fetch sensitive data from NETWAVE MNG6200 devices, specifically through certain OIDs related to user credentials.

What to do

If exploited, an attacker could easily discover the device credentials, potentially leading to unauthorized access and control over NETWAVE devices. Imagine an unwelcome guest gaining entry to your cozy gathering, turning a fun party into a disaster! To protect your devices, consider disabling SNMP access if it’s not needed and ensure that strong, unique credentials are in place. Additionally, check if any firmware updates are available to address this issue. Staying vigilant will help keep your devices secure! You've got this! Implement these fixes, and you'll be the hero of your network! 🦸

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01513 · 74.3th percentile
Published
2018-12-23T21:00Z
EPSS history
Timeline
  • 23 DEC 21:00Z
    NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and…
    cvelistv5