High severity · published Jan 9, 2019
CVE-2018-0676
BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and execute an arbitrary…
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and execute an arbitrary command via unspecified vectors.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Bn-sdwbp3 Firmware · Panasonic
through 1.0.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0676
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0676
Third Party Advisory
https://jvn.jp/en/jp/JVN65082538/index.html
Vendor Advisory
https://p3.support.panasonic.com/faq/show/5017?&site_domain=p3
More from Bn-sdwbp3 Firmware
6.8
CVE-2018-0678
Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vectors
6.8
CVE-2018-0677
BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspecified vectors