Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).
| CVE | CVE-2018-18871 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 9.8 / 10 |
| EPSS | 1.7% en 30 días (percentil 76) |
| CWE | CWE-640 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Productos afectados (catálogo NVD)
gigasetpro/maxwell_basicgigasetpro/maxwell_basic_firmware