CVE-2018-6908 An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allowing an unauthenticated attacker to perform authenticated...
CriticalCVSS 9.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allowing an unauthenticated attacker to perform authenticated actions on the device via a 127.0.0.1:port value in the HTTP 'Host' header, as demonstrated by retrieving credentials.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rainmachine mini-8 firmware | >= 4.0.539, <= 4.0.975 | No fix listed |
| rainmachine touch hd 12 firmware | >= 4.0.539, <= 4.0.974 | No fix listed |
References
- www.irongeek.com exploit third-party-advisory