Orange

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

Orange records in CISA KEV

No Orange vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Arv7519rw22 Livebox 2.1 Firmware 4 records MEDIUM Airbox Firmware 3 records MEDIUM Livebox 1.1 Firmware 1 record MEDIUM

Records

4 records in Arv7519rw22 Livebox 2.1 Firmware · all components

TI-2018-14430 CVE-2018-20377 · GHSA-rhx5-cpq6-6ccf

Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials…

MEDIUM 53

Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /get_getnetworkconf.cgi on port 8080, leading to full control if the admin password equals the Wi-Fi password or has the default…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.07721 Published 2018-12-23 No fix listed

TI-2018-14600 CVE-2018-20577 · GHSA-xc55-wr52-9hhw

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall_SPI.exe…

MEDIUM 40

Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe, cgi-bin/firewall_SPI.exe, cgi-bin/setup_remote_mgmt.exe, cgi-bin/setup_pass.exe, and cgi-bin/upgradep.exe CSRF.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00581 Published 2018-12-28 No fix listed CWE-352

TI-2018-14598 CVE-2018-20575 · GHSA-j49g-v8v5-8633

Orange Livebox 00.96.320S devices have an undocumented /system_firmwarel.stm URI for…

LOW 35

Orange Livebox 00.96.320S devices have an undocumented /system_firmwarel.stm URI for manual firmware update.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0098 Published 2018-12-28 No fix listed CWE-20

TI-2018-14599 CVE-2018-20576 · GHSA-c622-72w6-7cfr

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and…

LOW 25

Orange Livebox 00.96.320S devices allow cgi-bin/autodialing.exe and cgi-bin/phone_test.exe CSRF, leading to arbitrary outbound telephone calls to an attacker-specified telephone number.

CVSS 3.0MEDIUM 5.4 Network No auth User interaction EPSS 0.00412 Published 2018-12-28 No fix listed CWE-352

Open these records in search →

Critical	3
High	4
Medium	1
Low	0
No CVSS	0