CVE-2018-10252 - CVE House
Back to Database
Status published High CVE-2018-10252

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices....

Vulnerability Description

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its current time of day in responses, it is possible to step backward through possible session values until a working one is found. Once a working session ID is found, an attacker then has admin control of the device and can add a secondary SSID to create a backdoor to the network.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10252

Credits & Attribution

No credits recorded in the NVD database.

References

More from actiontec

View All →
CVE-2019-12789
An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as...
Medium 6.8
CVE-2018-19922
Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page...
Medium 6.1
CVE-2018-15557
An issue was discovered in the Quantenna WiFi Controller on...
High 8.8
CVE-2018-15556
The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows...
Critical 9.8
CVE-2018-15555
On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login...
Critical 9.8

Affected Vendor

Affected Software

wcb6200q firmware
Vulnerable Versions:
0

Timeline

Official Publish: May 14th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.