CVE-2017-14243

An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administrative settings and obtain cleartext credentials from HTML source, as demonstrated by info.cgi, upload.cgi, backupsettings.cgi, pppoe.cgi, resetrouter.cgi, and password.cgi.

• CWE-287

• https://www.exploit-db.com/exploits/42739/Third Party Advisory, VDB Entry
• https://www.techipick.com/iball-baton-adsl2-home-router-utstar-wa3002g4-adsl-broadband-modem-authentication-bypassThird Party Advisory
• https://www.exploit-db.com/exploits/42739/Third Party Advisory, VDB Entry
• https://www.techipick.com/iball-baton-adsl2-home-router-utstar-wa3002g4-adsl-broadband-modem-authentication-bypassThird Party Advisory

Published

Sep 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14238SQL injection vulnerability in admin/menus/edit.php in Dolib…
• CVE-2017-14239Multiple cross-site scripting (XSS) vulnerabilities in Dolib…
• CVE-2017-1424IBM Business Process Manager 8.5.7 is vulnerable to cross-si…
• CVE-2017-14240There is a sensitive information disclosure vulnerability in…
• CVE-2017-14241Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM…
• CVE-2017-14242SQL injection vulnerability in don/list.php in Dolibarr vers…
• CVE-2017-14244An authentication bypass vulnerability on iBall Baton ADSL2+…9.8
• CVE-2017-14245An out of bounds read in the function d2alaw_array() in alaw…
• CVE-2017-14246An out of bounds read in the function d2ulaw_array() in ulaw…
• CVE-2017-14247SQL Injection exists in the EyesOfNetwork web interface (aka…
• CVE-2017-14248A heap-based buffer over-read in SampleImage() in MagickCore…
• CVE-2017-14249ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImag…