CVE-2018-16591

CVE-2018-16591 affects FURUNO FELCOM 250 and FELCOM 500 devices. The issue allows unauthenticated users to change passwords for Admin, Log, and Service accounts, as well as the protected SMS panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi. Documented impact is creden...

CVE-2018-16705

The CVE-2018-16705 entry affects FURUNO FELCOM 250 and FELCOM 500 devices, where an unauthenticated access flaw allows reading the xml/permission.xml file. This file exposes all usernames and passwords (including Admin and Service accounts) with unsalted MD5 hashes and reveals the SMS server pass...

CVE-2018-16590

CVE-2018-16590 affects FURUNO FELCOM 250 and 500 devices, where authentication relies solely on client-side JavaScript in login.js. The root cause is described as client-side authentication, with no corroborated server-side validation in the provided documents. CVSS3 metrics indicate a critical s...