CVE-2018-16591

FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-09-10

Last modified

2024-08-05

Weaknesses

CWE-862

Affected products

• Felcom 250 Firmware (Furuno)
• Felcom 500 Firmware (Furuno)

References

• https://cyberskr.com/blog/furuno-felcom.html
• https://gist.github.com/CyberSKR/2c30d964d48b5e1518ded88bd953b710