CVE-2018-12456

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2018/Oct/18Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2018/Oct/18Exploit, Mailing List, Third Party Advisory

Timeline

Published: Oct 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-124578.8expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.CVE-2018-124586.5An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertio CVE-2018-124596.5An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger CVE-2018-12466.1Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially explo CVE-2018-124606.5libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI CVE-2018-124617.5Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation.CVE-2018-124626.1NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.CVE-2018-124639.8An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated CVE-2018-124649.8A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthen CVE-2018-124657.2An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote atta CVE-2018-124666.5openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.CVE-2018-124676.5Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:Ini