Quantum Secular Labs / Blog / Advisories

CVE-2018-20393: Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU, CWA0101…

CVE-2018-20393 is rated critical with a CVSS v3.0 base score of 9.8 and NVD lists 8 affected products, including Technicolor Cga0111 Firmware. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU, CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC, DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a, TC7110.AR STD3.38.03, TC7110.B STC8.62.02, TC7110.D STDB.79.02, TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT, and TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Severity breakdown

CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Affected products

  • Technicolor Cga0111 Firmware: cga0111e-es-13-e23e-c8000r5712-170217-0829-tru
  • Technicolor Cga0101 Firmware: cwa0101e-a23e-c7000r5712-170315-skc
  • Technicolor Dpc3928sl Firmware: d3928sl-psip-13-a010-c3420r55105-170214a
  • Technicolor Tc7110.Ar Firmware: std3.38.03
  • Technicolor Tc7110.B Firmware: stc8.62.02
  • Technicolor Tc7110.D Firmware: stdb.79.02
  • Technicolor Tc7200.D1i Firmware: tc7200.d1ie-n23e-c7000r5712-170406-hat
  • Technicolor Tc7200.Th2v2.D1i Firmware: sc05.00.22

References