CVE-2018-10578
📋 TL;DR
This vulnerability allows attackers to bypass password validation on WatchGuard AP series access points, enabling unauthorized password changes. Affected devices include AP100, AP102, AP200 with firmware before 1.2.9.15, and AP300 with firmware before 2.0.0.10.
💻 Affected Systems
- WatchGuard AP100
- WatchGuard AP102
- WatchGuard AP200
- WatchGuard AP300
📦 What is this software?
Ap100 Firmware by Watchguard
Ap102 Firmware by Watchguard
Ap200 Firmware by Watchguard
Ap300 Firmware by Watchguard
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to change admin password, gain persistent access, and pivot to internal networks.
Likely Case
Unauthorized administrative access to the access point, enabling network configuration changes and traffic interception.
If Mitigated
Limited impact if strong network segmentation and monitoring are in place, though device control may still be lost.
🎯 Exploit Status
Exploitation requires access to the change password interface, which typically requires some level of authentication. The vulnerability is in the validation logic of the old password field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: AP100/AP102/AP200: 1.2.9.15 or later; AP300: 2.0.0.10 or later
Vendor Advisory: http://seclists.org/fulldisclosure/2018/May/12
Restart Required: Yes
Instructions:
1. Log into WatchGuard support portal. 2. Download appropriate firmware version for your device. 3. Upload firmware via device web interface. 4. Reboot device after installation completes.
🔧 Temporary Workarounds
Disable web management interface
allDisable HTTP/HTTPS management access to reduce attack surface
Network segmentation
allPlace access points in isolated network segments with strict firewall rules
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the management interface
- Enable detailed logging and monitoring for password change attempts and unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > Status > Firmware VersionCheck Version:
No CLI command available; check via web interface or SSH to device if enabledVerify Fix Applied:
Verify firmware version is 1.2.9.15 or later for AP100/AP102/AP200, or 2.0.0.10 or later for AP300📡 Detection & Monitoring
Log Indicators:
- Multiple failed password change attempts
- Successful password changes from unusual IP addresses
- Authentication logs showing admin password changes
Network Indicators:
- HTTP POST requests to /cgi-bin/change_password.cgi or similar endpoints
- Unusual management interface access patterns
SIEM Query:
source="watchguard" AND (event_type="password_change" OR uri_path="*change_password*")