CVE-2018-16591

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cyberskr.com/blog/furuno-felcom.htmlExploit, Technical Description, Third Party Advisory
https://gist.github.com/CyberSKR/2c30d964d48b5e1518ded88bd953b710Third Party Advisory
https://cyberskr.com/blog/furuno-felcom.htmlExploit, Technical Description, Third Party Advisory
https://gist.github.com/CyberSKR/2c30d964d48b5e1518ded88bd953b710Third Party Advisory

Timeline

Published: Sep 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-165938.8The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Shell Metacharacter Injection.CVE-2018-165948.1The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices allows Directory Traversal.CVE-2018-165956.5The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices has a Buffer Overflow.CVE-2018-165967.5A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09 CVE-2018-165975.5An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to mo CVE-2018-165985.9An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI CVE-2018-165995.9An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI CVE-2018-16605.4IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc CVE-2018-166005.9An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI CVE-2018-166018.1An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI CVE-2018-166025.9An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI CVE-2018-166035.9An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHI