CVE-2018-12258

An issue was discovered on Momentum Axel 720P 5.1.8 devices. Custom Firmware Upgrade is possible via an SD Card. With physical access, an attacker can upgrade the firmware in under 60 seconds by inserting an SD card containing the firmware with name 'ezviz.dav' and rebooting.

• https://rchase.com/downloads/momentum-iot-penetration-test-report.pdfExploit, Third Party Advisory
• https://rchase.com/downloads/momentum-iot-penetration-test-report.pdfExploit, Third Party Advisory

Published

Jun 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1225Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12250An issue was discovered in Elite CMS Pro 2.01. In /admin/add…
• CVE-2018-12254router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 comp…
• CVE-2018-12255An XSS issue was discovered in InvoicePlane 1.5.10 via the "…
• CVE-2018-12256admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 all…
• CVE-2018-12257An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-12259An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-1226Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12260An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-12261An issue was discovered on Momentum Axel 720P 5.1.8 devices.…
• CVE-2018-12262Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-12263portfolioCMS 1.0.5 allows upload of arbitrary .php files via…