CVEvulnerability
CVE-2018-15556
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-06-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-287
Description
The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty password by using the enabled onboard UART headers.
Affected configurations
• actiontec web6000q firmware 1.1.02.22
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Jun/1 Exploit, Mailing List, Third Party Advisory