High severity · published May 2, 2018
CVE-2018-10577
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10
8.8
CVSS
6.4%
EPSS
No
On KEV
Description
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. File upload functionality allows any users authenticated on the web interface to upload files containing code to the web root, allowing these files to be executed as root.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ap100 Firmware · Watchguard
before 1.2.9.15 · source: NVD
AF
Ap102 Firmware · Watchguard
before 1.2.9.15 · source: NVD
AF
Ap200 Firmware · Watchguard
before 1.2.9.15 · source: NVD
AF
Ap300 Firmware · Watchguard
before 2.0.0.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10577
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10577
Mailing List
http://seclists.org/fulldisclosure/2018/May/12
www.exploit-db.com
https://www.exploit-db.com/exploits/45409/
More from Ap100 Firmware
9.8
CVE-2018-10578
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10
9.8
CVE-2018-10575
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15
7.8
CVE-2018-10576
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15