CVE-2020-10376

Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header

published March 11, 2020

CVSS
—
EPSS
1%
Percentile
64.4
In the wild
Unconfirmed
What it is

⚠️ A simple sniffing attack could expose your passwords! Remote attackers can capture the "Authorization: Basic" HTTP header from Technicolor TC7337NET devices, making it way too easy to access sensitive information. 🔍 Think of it like a busy café where your conversations are overheard — if someone can just lean in and listen, they could pick up all your secrets without you even noticing! Your passwords in network packets are just as vulnerable to being eavesdropped on. An attacker with access to the network could easily grab user credentials, leading to unauthorized access to accounts linked to the device. This could mean lost data privacy and a potential domino effect of compromised accounts. Protecting your data from such an attack is crucial to keep prying eyes at bay!

Put simply

Think of it like a busy café where your conversations are overheard — if someone can just lean in and listen, they could pick up all your secrets without you even noticing! Your passwords in network packets are just as vulnerable to being eavesdropped on. This vulnerability allows attackers to retrieve plain-text passwords by monitoring network traffic for unencrypted HTTP headers, specifically the Basic Authorization header used for authentication.

What to do

An attacker with access to the network could easily grab user credentials, leading to unauthorized access to accounts linked to the device. This could mean lost data privacy and a potential domino effect of compromised accounts. Protecting your data from such an attack is crucial to keep prying eyes at bay! To mitigate this risk, ensure that your devices are updated to the latest firmware. Additionally, consider enabling HTTPS to encrypt communication and prevent network sniffing. Regularly check access logs for any unusual activity as well. You've got this! By following these steps, you can secure your network and keep your data safe. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01064 · 64.4th percentile
Published
2020-03-11T13:35Z
EPSS history
Timeline
  • 11 MAR 13:35Z
    Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header
    cvelistv5