CVE-2017-18374: Command Injection
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a hardcoded service account with the username true and password true. These accounts can be used to login to the web interface, exploit authenticated command injections and change router settings for malicious purposes.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-18374?
CVE-2017-18374 is a vulnerability in the ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router, which allows unauthorized access through default passwords.
How severe is CVE-2017-18374?
CVE-2017-18374 has a severity rating of 8.8 (Critical).
Which software is affected by CVE-2017-18374?
The Zyxel P660HN-T1A Routers with firmware versions 7.3.8.0 and 7.3.15.0 are affected by CVE-2017-18374.
Are the Billion 5200W-T and Zyxel P660HN-T1A v2 routers vulnerable?
No, the Billion 5200W-T and Zyxel P660HN-T1A v2 routers are not vulnerable to CVE-2017-18374.
How can I fix CVE-2017-18374?
To fix CVE-2017-18374, it is recommended to update the firmware of the affected Zyxel P660HN-T1A routers to a version that addresses the vulnerability and change all default passwords.