PT-2026-108939 · Unknown · Phpnuxbill
CVSS v3.1
7.1
عالية
| المتجه | AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
PHPNuxBill versions prior to 2025.3.21
Description
An authentication bypass exists in RADIUS CHAP verification. The issue occurs because the
Password::chap verify() function returns true even when the supplied response does not match. An attacker who knows a valid customer or PPPoE username can authenticate via MikroTik hotspot or PPPoE CHAP using any incorrect password to gain network access and consume the associated customer plan.Recommendations
Update PHPNuxBill to version 2025.3.21 or later.
استغلال
إصلاح
Improper Authentication
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Phpnuxbill