CVE-2017-18373

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username user3 and and a long password consisting of a repetition of the string 0123456789. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txtExploit, Third Party Advisory
https://seclists.org/fulldisclosure/2017/Jan/40Exploit, Mailing List, Third Party Advisory
https://ssd-disclosure.com/index.php/archives/2910Exploit, Technical Description, Third Party Advisory
https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txtExploit, Third Party Advisory
https://seclists.org/fulldisclosure/2017/Jan/40Exploit, Mailing List, Third Party Advisory
https://ssd-disclosure.com/index.php/archives/2910Exploit, Technical Description, Third Party Advisory

Timeline

Published: May 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-183748.8The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passw CVE-2017-183758.8Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.CVE-2017-183768.8An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write acce CVE-2017-183779.8An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metachar CVE-2017-183789.8In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() thr CVE-2017-183799.8In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c.CVE-2017-183807.5edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled CVE-2017-183817.2The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.CVE-2017-183822.7cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).CVE-2017-183837.8cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).CVE-2017-183843.8cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).CVE-2017-183855.5cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).