CVE-2018-17873

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An incorrect access control vulnerability in the FTP configuration of WiFiRanger devices with firmware version 7.0.8rc3 and earlier allows an attacker with adjacent network access to read the SSH Private Key and log in to the root account.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Oct 23, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-178746.1ExpressionEngine before 4.3.5 has reflected XSS.CVE-2018-178758.8A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated users to execute commandsCVE-2018-178766.1A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.CVE-2018-178777.5A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an exterCVE-2018-178789.8Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintCVE-2018-178799.8An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There areCVE-2018-17884.4IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force ICVE-2018-178807.5On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a rebootCVE-2018-178819.8On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger CVE-2018-178827.5An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an EtCVE-2018-178836.1An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious CVE-2018-178846.1XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-ad
CVE-2018-17873: High severity, CVSS 8.8 | Vulnix