Secuno
ENNL
Book demo

CVE-2018-17558

Abus Tvip 10000 Firmware command injection

9.8 CRITICALEPSS 2.51%
  1. Published26 Oct 2023

Description

Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Abus Tvip 10000 Firmwareall versions
Abus Tvip 10001 Firmwareall versions
Abus Tvip 10005a Firmwareall versions
Abus Tvip 10005b Firmwareall versions
Abus Tvip 10005 Firmwareall versions
Abus Tvip 10050 Firmwareall versions
Abus Tvip 10051 Firmwareall versions
Abus Tvip 10055a Firmwareall versions
Abus Tvip 10055b Firmwareall versions
Abus Tvip 10500 Firmwareall versions
Abus Tvip 10550 Firmwareall versions
Abus Tvip 11000 Firmwareall versions
Abus Tvip 11050 Firmwareall versions
Abus Tvip 11500 Firmwareall versions
Abus Tvip 11501 Firmwareall versions
Abus Tvip 11502 Firmwareall versions
Abus Tvip 11550 Firmwareall versions
Abus Tvip 11551 Firmwareall versions
Abus Tvip 11552 Firmwareall versions
Abus Tvip 20000 Firmwareall versions
Abus Tvip 20050 Firmwareall versions
Abus Tvip 20500 Firmwareall versions
Abus Tvip 20550 Firmwareall versions
Abus Tvip 21000 Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Frequently asked

Is CVE-2018-17558 being actively exploited?

CVE-2018-17558 is not in the CISA KEV catalog. Its EPSS exploit probability is 2.51%.

How severe is CVE-2018-17558?

CVE-2018-17558 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 2.51% probability of exploitation.

Which products are affected by CVE-2018-17558?

Affected products include Abus Tvip 10000 Firmware, Abus Tvip 10001 Firmware, Abus Tvip 10005a Firmware, Abus Tvip 10005b Firmware, Abus Tvip 10005 Firmware, and 19 more.

How do I fix CVE-2018-17558?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2018-17558 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.