What’s Vulnerable › Vulnerabilities

CVE-2018-10252

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-14 · updated 2026-06-17
• Weakness: CWE-384

Description

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its current time of day in responses, it is possible to step backward through possible session values until a working one is found. Once a working session ID is found, an attacker then has admin control of the device and can add a secondary SSID to create a backdoor to the network.

Affected products

• Actiontec WCB6200Q: before 1.1.10.20a — fixed in 1.1.10.20a

How to fix

Upgrade to a fixed version: Actiontec WCB6200Q 1.1.10.20a. Check the vendor advisory for mitigations.

References

• https://actiontecsupport.zendesk.com/hc/en-us/articles/115000432163-WCB6200Q-Firmware-Upgrade
• https://actiontecsupport.zendesk.com/hc/en-us/articles/115000432163-WCB6200Q-Firmware-Upgrade

Get alerted when CVE-2018-10252 or the next vulnerability affects your stack