CVE-2018-9149

The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker can start the device's TELNET service as a backdoor.

• CWE-798

• https://www.slideshare.net/secret/qrHwDOJ71eLg7fExploit, Third Party Advisory
• https://www.slideshare.net/secret/qrHwDOJ71eLg7fExploit, Third Party Advisory

Published

Apr 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9143On Samsung mobile devices with M(6.0) and N(7.x) software, a…
• CVE-2018-9144In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Inte…
• CVE-2018-9145In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.2…
• CVE-2018-9146Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-9147Cross-site scripting (XSS) vulnerabilities in version 7.5.7 …
• CVE-2018-9148Western Digital WD My Cloud v04.05.00-320 devices embed the …
• CVE-2018-9151A NULL pointer dereference bug in the function ObReferenceOb…
• CVE-2018-9153The plugin upload component in Z-BlogPHP 1.5.1 allows remote…
• CVE-2018-9154There is a reachable abort in the function jpc_dec_process_s…
• CVE-2018-9155Cross-site scripting (XSS) vulnerability in Open-AudIT Profe…
• CVE-2018-9156An issue was discovered on AXIS P1354 (IP camera) Firmware v…
• CVE-2018-9157An issue was discovered on AXIS M1033-W (IP camera) Firmware…