CVE-2018-9149

The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART

published April 1, 2018

CVSS
—
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.4th percentile
Published
2018-04-01T18:00Z
EPSS history
Timeline
  • 01 APR 18:00Z
    The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART
    cvelistv5