CVE-2018-12049

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/huykha/0381acb2dc580c728a79452b60fa082cBroken Link, Third Party Advisory
https://www.exploit-db.com/exploits/44886/Broken Link, Third Party Advisory, VDB Entry
https://gist.github.com/huykha/0381acb2dc580c728a79452b60fa082cBroken Link, Third Party Advisory
https://www.exploit-db.com/exploits/44886/Broken Link, Third Party Advisory, VDB Entry

Timeline

Published: Jun 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-12057.5Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could po CVE-2018-120519.8Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general CVE-2018-120529.8SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.CVE-2018-120537.5Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using director CVE-2018-120547.5Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.CVE-2018-120559.8Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.php, faq.php, about.ph CVE-2018-120567.5The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly CVE-2018-12067.8Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contai CVE-2018-120627.5The sell function of a smart contract implementation for SwftCoin (SWFTC), a tradable Ethereum ERC20 token, allows a potential trap that cou CVE-2018-120637.5The sell function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, allows a potential trap CVE-2018-120649.8tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.CVE-2018-120659.8A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP f