CVE-2018-12073

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue (e.g., in combination with a successful XSS, or at an unattended workstation) to change the admin password to an attacker-chosen value without knowing the current password.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/freetom/2a446a226d0e98807c8b0c1111ef2defThird Party Advisory
https://gist.github.com/freetom/2a446a226d0e98807c8b0c1111ef2defThird Party Advisory

Timeline

Published: Jun 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-120764.2A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within t CVE-2018-120787.5The mintToken function of a smart contract implementation for PolyAI (AI), a tradable Ethereum ERC20 token, has no period constraint, which CVE-2018-120797.5The mintToken function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, has no period constraint, w CVE-2018-120807.5The mintToken function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, has no period cons CVE-2018-120817.5The mintToken function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, has no period constraint, CVE-2018-120827.5The mintToken function of a smart contract implementation for Fujinto (NTO), a tradable Ethereum ERC20 token, has no period constraint, whic CVE-2018-120837.5The mintToken function of a smart contract implementation for GOAL Bonanza (GOAL), a tradable Ethereum ERC20 token, has no period constraint CVE-2018-120847.5The mintToken function of a smart contract implementation for BitAsean (BAS), a tradable Ethereum ERC20 token, has no period constraint, whi CVE-2018-120858.8Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE CVE-2018-120867.5Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.CVE-2018-120875.3Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over CVE-2018-120887.5S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present o