PT-2017-18516

CVE-2017-8770

Published

2017-09-20

Updated

2017-09-28

Description by

CVSS 2.0

7.8

High

MetricsAV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions BE126 WIFI repeater version 1.0

Description The issue allows attackers to read the entire filesystem on the device. This is achieved by using a crafted getpage parameter, enabling local file disclosure (LFD).

Recommendations For BE126 WIFI repeater version 1.0, avoid using the getpage parameter until a fix is available. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Hay Mizrachi

Omer Kaspi

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers