CVE-2018-20387
UnknownEPSS 1.51%
Last modified
CVE-2018-20387 is a vulnerability of currently unknown severity. Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.. EPSS estimates a 1.51% chance of exploitation in the next 30 days.
Description
Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bnmux | Bcw700j Firmware | 5.20.7 |
| Bnmux | Bcw710j Firmware | 5.30.6a |
| Bnmux | Bcw710j2 Firmware | 5.30.16 |
References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csvThird Party Advisory
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.htmlExploit, Third Party Advisory
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csvThird Party Advisory
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-20387?
Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
How severe is CVE-2018-20387?
Severity scoring for CVE-2018-20387 is pending analysis. The EPSS model estimates a 1.51% probability of exploitation in the next 30 days.
How do I fix CVE-2018-20387?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-20381Technicolor DPC2320 dpc2300r2-v202r1244101-150420a-v6 device…
- CVE-2018-20382Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 de…
- CVE-2018-20383ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow…9.8
- CVE-2018-20384iNovo Broadband IB-8120-W21 139.4410mp1.004200.002 and IB-81…
- CVE-2018-20385CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNI…
- CVE-2018-20386ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices al…9.8
- CVE-2018-20388Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 d…
- CVE-2018-20389D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 E…
- CVE-2018-2039Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-20390Kaonmedia CG2001-AN22A 1.2.1, CG2001-UDBNA 3.0.8, and CG2001…
- CVE-2018-20391TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote …
- CVE-2018-20392S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote …
Are you affected by CVE-2018-20387?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST