CVE-2018-20399: Critical severity motorola sbg901 firmware vulnerability

Published Dec 23, 2018

Updated

Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Affected Software

6 affected components

Motorola Sbg901 Firmware=sbg901-2.10.1.1-ga-00-581-nosh

Motorola SBG901=1.0

Motorola Sbg941 Firmware=sbg941-2.11.0.0-ga-07-624-nosh

Motorola SBG941=1.0

Motorola Svg1202 Firmware=svg1202-2.1.0.0-ga-14-ltsh

Motorola SVG1202=1.0

Event History

Dec 23, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-20399?

The severity of CVE-2018-20399 is critical with a CVSS score of 9.8.

How can remote attackers exploit CVE-2018-20399?

Remote attackers can exploit CVE-2018-20399 by sending SNMP requests to discover credentials.

Which devices are affected by CVE-2018-20399?

Motorola SBG901, SBG941, and SVG1202 devices are affected by CVE-2018-20399.

How do I fix CVE-2018-20399?

There is currently no known fix for CVE-2018-20399. It is recommended to contact the vendor for further assistance.

Where can I find more information about CVE-2018-20399?

More information about CVE-2018-20399 can be found at the following references: [securityfocus](http://www.securityfocus.com/bid/106320), [github](https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv), [misteralfa-hack](https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html)