CVE-2018-20399

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-23 · updated 2026-06-17
Weakness: CWE-522

Description

Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Affected products

Motorola Sbg901 Firmware: sbg901-2.10.1.1-ga-00-581-nosh
Motorola Sbg941 Firmware: sbg941-2.11.0.0-ga-07-624-nosh
Motorola Svg1202 Firmware: svg1202-2.1.0.0-ga-14-ltsh

References

http://www.securityfocus.com/bid/106320
https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
http://www.securityfocus.com/bid/106320
https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html

Get alerted when CVE-2018-20399 or the next vulnerability affects your stack