What’s Vulnerable › Vulnerabilities

CVE-2018-18871

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-12-20 · updated 2026-06-17
• Weakness: CWE-640

Description

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).

Affected products

• Gigasetpro Maxwell Basic Firmware: 2.22.7

References

• https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Gigaset_Maxwell.pdf?_=1541431343
• https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Gigaset_Maxwell.pdf?_=1541431343

Get alerted when CVE-2018-18871 or the next vulnerability affects your stack