SB2018070914 - Privilege escalation in ADB Broadband Gateways / Routers
Published: July 9, 2018
Security Bulletin ID
SB2018070914
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Privilege escalation (CVE-ID: CVE-2018-13108)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
The vulnerability allows a local attacker can gain elevated privileges on the target system.
2) Authorization bypass (CVE-ID: CVE-2018-13109)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
The vulnerability allows a local attacker can gain elevated privileges on the target system.
The weakness exists in ADB broadband gateways / routers based on the Epicentro platform due to authorization bypass. A local attacker can access and manipulate settings within the web interface that are forbidden to end users (e.g., by the ISP) and enable the TELNET server or other settings as well.
3) Privilege escalation (CVE-ID: CVE-2018-13110)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
The vulnerability allows a local attacker can gain elevated privileges on the target system.
The weakness exists in ADB broadband gateways / routers based on the Epicentro platform due to unspecified flaw. A local attacker can gain access to the command line interface (CLI) if previously disabled by the ISP, escalate privileges, and perform further attacks.
Remediation
Install update from vendor's website.