VULNERABILITY INTELLIGENCE

CVE-2018-16705

CVSS score9.8 CRITICAL

EPSS probability1.57%

CISA KEVNot currently listed

Published2018-09-10

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

cve@mitre.org — Exploit, Technical Description, Third Party Advisory
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory