CVE-2018-12257

An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download.

• CWE-295

• https://rchase.com/downloads/momentum-iot-penetration-test-report.pdfExploit, Third Party Advisory
• https://rchase.com/downloads/momentum-iot-penetration-test-report.pdfExploit, Third Party Advisory

Published

Jun 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12249An issue was discovered in mruby 1.4.1. There is a NULL poin…7.5
• CVE-2018-1225Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12250An issue was discovered in Elite CMS Pro 2.01. In /admin/add…
• CVE-2018-12254router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 comp…
• CVE-2018-12255An XSS issue was discovered in InvoicePlane 1.5.10 via the "…
• CVE-2018-12256admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 all…
• CVE-2018-12258An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-12259An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-1226Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12260An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-12261An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-12262Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…