CVE-2018-11094
Critical · 9.8CVSS
9.8
EPSS
33.4%
Published
May 15, 2018
CISA due date
—
The record
An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. For example, when an HTTP POST request is made to /cgi-bin/ExportSettings.sh, the username, password, and other details are retrieved.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87950 Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows… CWE-798
- CVE-2026-75940 A vulnerability was reported in Lenovo Health Android Application, distributed… CWE-798
- CVE-2026-17038 DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting… CWE-798
- CVE-2026-81640 An attacker could derive the camera's Wi-Fi password and connect to its wireless network. CWE-798
- CVE-2026-79740 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-798
- CVE-2026-79950 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-798
- CVE-2026-79738 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-798
- CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-798