CVE-2018-16201

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on the same network segment to login to the administrators settings screen and change the configuration or execute arbitrary OS commands.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Toshiba Lighting & Technology Corporation	Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A	(Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier)

References

http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htmVendor Advisory
https://jvn.jp/en/jp/JVN99810718/index.htmlThird Party Advisory
http://www.tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htmVendor Advisory
https://jvn.jp/en/jp/JVN99810718/index.htmlThird Party Advisory

Timeline

Published: Jan 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-162028.6Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-b CVE-2018-162039.8PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the Postgr CVE-2018-162044.8Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrar CVE-2018-162055.4Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page m CVE-2018-162066.1Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script CVE-2018-162076.5PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit CVE-2018-16216.7IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by CVE-2018-162106.1WAGO 750-88X and WAGO 750-89X Ethernet Controller devices, versions 01.09.18(13) and before, have XSS in the SNMP configuration via the webs CVE-2018-162168.0A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.CVE-2018-162178.8The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated a CVE-2018-162188.8A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows CVE-2018-162198.8A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the s