What’s Vulnerable › Vulnerabilities

CVE-2018-16705

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-09-10 · updated 2026-06-17
• Weakness: CWE-200

Description

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext.

Affected products

• Furuno Felcom 250 Firmware: all versions
• Furuno Felcom 500 Firmware: all versions

References

• https://cyberskr.com/blog/furuno-felcom.html
• https://gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31
• https://cyberskr.com/blog/furuno-felcom.html
• https://gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31

Get alerted when CVE-2018-16705 or the next vulnerability affects your stack