CVE-2018-15555

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onboard UART headers.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-662

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-155569.8The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty p CVE-2018-155578.8An issue was discovered in the Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 devices. An attacker can statically set his/CVE-2018-155596.1The editor in Xiuno BBS 4.0.4 allows stored XSS.CVE-2018-15565.4IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc CVE-2018-155607.5PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functi CVE-2018-155626.1CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.CVE-2018-155636.1_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.CVE-2018-155648.8An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?del CVE-2018-155658.8An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. CVE-2018-155666.1tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter.CVE-2018-155676.1CMSUno before 1.5.3 has XSS via the title field.CVE-2018-155688.8tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html.