CVE-2018-12456

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 10, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-124578.8expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.CVE-2018-124586.5An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertioCVE-2018-124596.5An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may triggerCVE-2018-12466.1Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploCVE-2018-124606.5libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVICVE-2018-124617.5Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation.CVE-2018-124626.1NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.CVE-2018-124639.8An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticatedCVE-2018-124649.8A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenCVE-2018-124657.2An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attaCVE-2018-124666.5openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.CVE-2018-124676.5Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:Ini
CVE-2018-12456: High severity, CVSS 8.8 | Vulnix