CVE-2017-8771
CriticalSummary
On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username: "root", password: "root"). The attacker can make a user connected to the repeater click on a malicious link that will log into the telnet and infect the device with malicious code.
Risk Assessment
The risk to the organization is the potential for remote control of devices, which could lead to further attacks on the internal network and data breaches.
Recommendation
It is recommended to disable telnet and change default credentials to stronger passwords. Additionally, monitoring network traffic for suspicious activities is advisable.
Other vulnerabilities in BE126 WIFI repeater 1.0
See all- CVE-2017-8770High
There is a LFD (local file disclosure) vulnerability on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter.
- CVE-2017-8772Critical
On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username: "root", password: "root"). After logging in, they can read, write to the file system, or execute any code.
Original NVD description (English source)
On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root"). The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the device with malicious code.