Unscored CVE-2018-16591 EUVD-2018-8398GHSA-jj3p-f5rj-jw7r

FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as th…

Published Sep 10, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi.

References

https://cyberskr.com/blog/furuno-felcom.html
https://gist.github.com/CyberSKR/2c30d964d48b5e1518ded88bd953b710