Watchguard AP100/AP102/AP200 up to 1.2.9.14 Web UI improper authentication

Summaryinfo

A vulnerability was found in Watchguard AP100, AP102 and AP200 up to 1.2.9.14. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Web UI. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2018-10576. Local access is required to approach this attack. Moreover, an exploit is present. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Watchguard AP100, AP102 and AP200 up to 1.2.9.14. This issue affects an unknown code block of the component Web UI. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account (instead of the dedicated web-only user).

The bug was discovered 05/01/2018. The weakness was disclosed 04/30/2018 (Website). It is possible to read the advisory at watchguardsupport.secure.force.com. The identification of this vulnerability is CVE-2018-10576 since 04/30/2018. Attacking locally is a requirement. The requirement for exploitation is a simple authentication. Technical details are unknown but a public exploit is available.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 1.2.9.15 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (45409). The entries VDB-117226 and VDB-117311 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Watchguard

Name

• AP100
• AP102
• AP200

Version

• 1.2.9.0
• 1.2.9.1
• 1.2.9.2
• 1.2.9.3
• 1.2.9.4
• 1.2.9.5
• 1.2.9.6
• 1.2.9.7
• 1.2.9.8
• 1.2.9.9
• 1.2.9.10
• 1.2.9.11
• 1.2.9.12
• 1.2.9.13
• 1.2.9.14

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion