A vulnerability was found in Alcatel-Lucent I-240W-Q GPON ONT 3FE54567BOZJ19. It has been rated as critical. Affected by this issue is some unknown functionality of the component Telnet/SSH. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH interfaces.

The bug was discovered 02/27/2019. The weakness was released 03/05/2019. This vulnerability is handled as CVE-2019-3918 since 01/03/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1110.001.

The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at 131340, 131339, 131338 and 131337.

Productinfo

Vendor

• Alcatel-Lucent

Name

• I-240W-Q GPON ONT

Version

• 3FE54567BOZJ19

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion