CVE-2018-10532

An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70_E1_02.00_19 devices. Hardcoded root SSH credentials were discovered to be stored within the "core_app" binary utilised by the EE router for networking services. An attacker with knowledge of the default password (oelinux123) could login to the router via SSH as the root user, which could allow for the loss of confidentiality, integrity, and availability of the system. This would also allow for the bypass of the "AP Isolation" mode that is supported by the router, as well as the settings for multiple Wireless networks, which a user may use for guest clients.

• CWE-798

• https://blog.jameshemmings.co.uk/2018/10/24/4gee-hh70-router-vulnerability-disclosure/Exploit, Mitigation, Third Party Advisory
• https://www.theregister.co.uk/2018/10/26/ee_4gee_hh70_ssh_backdoor/Third Party Advisory
• https://blog.jameshemmings.co.uk/2018/10/24/4gee-hh70-router-vulnerability-disclosure/Exploit, Mitigation, Third Party Advisory
• https://www.theregister.co.uk/2018/10/26/ee_4gee_hh70_ssh_backdoor/Third Party Advisory

Published

Oct 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10523CMS Made Simple (CMSMS) through 2.2.7 contains a physical pa…
• CVE-2018-10527EasyCMS 1.3 is prone to Stored XSS when posting an article; …
• CVE-2018-10528An issue was discovered in LibRaw 0.18.9. There is a stack-b…8.8
• CVE-2018-10529An issue was discovered in LibRaw 0.18.9. There is an out-of…
• CVE-2018-1053In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.…
• CVE-2018-10531An issue was discovered in the America's Army Proving Ground…7.5
• CVE-2018-10534The _bfd_XX_bfd_copy_private_bfd_data_common function in peX…
• CVE-2018-10535The ignore_section_sym function in elf.c in the Binary File …
• CVE-2018-10536An issue was discovered in WavPack 5.1.0 and earlier. The WA…
• CVE-2018-10537An issue was discovered in WavPack 5.1.0 and earlier. The W6…
• CVE-2018-10538An issue was discovered in WavPack 5.1.0 and earlier for WAV…
• CVE-2018-10539An issue was discovered in WavPack 5.1.0 and earlier for DSD…