Actiontec WCB6200Q up to 1.1.10.20a Admin Login Cookie session fixiation

Summaryinfo

A vulnerability was found in Actiontec WCB6200Q up to 1.1.10.20a. It has been rated as critical. This affects an unknown part of the component Admin Login Cookie Handler. This manipulation causes session fixiation. This vulnerability is handled as CVE-2018-10252. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Actiontec WCB6200Q up to 1.1.10.20a. It has been declared as critical. Affected by this vulnerability is an unknown function of the component Admin Login Cookie Handler. The manipulation with an unknown input leads to a session fixiation vulnerability. The CWE definition for the vulnerability is CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its current time of day in responses, it is possible to step backward through possible session values until a working one is found. Once a working session ID is found, an attacker then has admin control of the device and can add a secondary SSID to create a backdoor to the network.

The bug was discovered 01/19/2017. The weakness was released 05/14/2018 (Website). It is possible to read the advisory at actiontecsupport.zendesk.com. This vulnerability is known as CVE-2018-10252 since 04/20/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 480 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Actiontec

Name

• WCB6200Q

Version

• 1.1.10.20a

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion