CVE-2018-9248

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header

published April 4, 2018

CVSS
โ€”
EPSS
14%
Percentile
96.6
In the wild
Unconfirmed
What it is

โš ๏ธ A sneaky cookie can open the door wide! By simply adding a "Cookie: Name=0admin" header, attackers can bypass authentication on FiberHome VDSL2 Modem HG 150-UB devices. ๐Ÿ”“ Think of it like a restaurant where the chef hands out the secret recipe to anyone who orders a specific dish without verifying their identity. This vulnerability allows unauthorized individuals to access sensitive settings without proper authentication. An attacker could potentially waltz in and change critical settings on your modem, leading to unauthorized access to your network. This could result in data exposure, service disruptions, or even hijacking your connection! Yikes!

Put simply

Think of it like a restaurant where the chef hands out the secret recipe to anyone who orders a specific dish without verifying their identity. This vulnerability allows unauthorized individuals to access sensitive settings without proper authentication. This vulnerability allows attackers to bypass authentication by manipulating the cookie headers sent to the modem, thus gaining unauthorized access to the device's configuration.

What to do

An attacker could potentially waltz in and change critical settings on your modem, leading to unauthorized access to your network. This could result in data exposure, service disruptions, or even hijacking your connection! Yikes! To mitigate this risk, ensure your modem's firmware is updated to the latest version. Check if there's a security patch available from FiberHome and apply it immediately. Additionally, consider disabling remote management features if they are not needed. ๐Ÿ›ก๏ธ You've got this! Stay proactive and keep your network secure! ๐Ÿš€

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.14470 ยท 96.6th percentile
Published
2018-04-04T15:00Z
EPSS history
Timeline
  • 04 APR 15:00Z
    FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header
    cvelistv5