Vulnerability CVE-2018-10285
Published: 2018-04-22

Description:
The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authentication.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Ericsson-LG iPECS NMS A.1Ac Credential Disclosure
Berk Cem Goksel
25.04.2018

Type:

CWE-732

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Ericssonlg -> Ipecs nms 

 References:
https://gist.github.com/berkgoksel/b8e15cb5742540c6987e9d837d6fa8b1
https://www.exploit-db.com/exploits/44515/
Copyright 2024, cxsecurity.com

 

Back to Top