CVE-2018-20380
UnknownEPSS 1.60%
Last modified
CVE-2018-20380 is a vulnerability of currently unknown severity. Ambit DDW2600 5.100.1009, DDW2602 5.105.1003, T60C926 4.64.1012, and U10C019 5.66.1026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.. EPSS estimates a 1.60% chance of exploitation in the next 30 days.
Description
Ambit DDW2600 5.100.1009, DDW2602 5.105.1003, T60C926 4.64.1012, and U10C019 5.66.1026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ubeeinteractive | Ambit Ddw2600 Firmware | 5.100.1009 |
| Ubeeinteractive | Ambit Ddw2602 Firmware | 5.105.1003 |
| Ubeeinteractive | Ambit T60c926 Firmware | 4.64.1012 |
| Ubeeinteractive | Ambit U10c019 Firmware | 5.66.1026 |
References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csvThird Party Advisory
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.htmlExploit, Third Party Advisory
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csvThird Party Advisory
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-20380?
Ambit DDW2600 5.100.1009, DDW2602 5.105.1003, T60C926 4.64.1012, and U10C019 5.66.1026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
How severe is CVE-2018-20380?
Severity scoring for CVE-2018-20380 is pending analysis. The EPSS model estimates a 1.60% probability of exploitation in the next 30 days.
How do I fix CVE-2018-20380?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-20375An issue was discovered in Tiny C Compiler (aka TinyCC or TC…
- CVE-2018-20376An issue was discovered in Tiny C Compiler (aka TinyCC or TC…
- CVE-2018-20377Orange Livebox 00.96.320S devices allow remote attackers to …
- CVE-2018-20378The L2CAP signaling channel implementation and SDP server im…
- CVE-2018-20379Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-16042…
- CVE-2018-2038Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-20381Technicolor DPC2320 dpc2300r2-v202r1244101-150420a-v6 device…
- CVE-2018-20382Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 de…
- CVE-2018-20383ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow…9.8
- CVE-2018-20384iNovo Broadband IB-8120-W21 139.4410mp1.004200.002 and IB-81…
- CVE-2018-20385CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNI…
- CVE-2018-20386ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices al…9.8
Are you affected by CVE-2018-20380?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST