CVE-2018-11741
📋 TL;DR
NEC Univerge Sv9100 WebPro 6.00.00 devices have predictable session IDs that allow attackers to hijack user sessions and access account information including cleartext passwords. This affects organizations using these specific NEC PBX devices with the vulnerable WebPro interface.
💻 Affected Systems
- NEC Univerge Sv9100 WebPro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the PBX system, unauthorized access to all user accounts, exposure of cleartext credentials, and potential lateral movement into connected networks.
Likely Case
Unauthorized access to user sessions, account information disclosure, credential theft, and potential privilege escalation on the PBX system.
If Mitigated
Limited impact if proper network segmentation, access controls, and monitoring are in place to detect session hijacking attempts.
🎯 Exploit Status
Exploit requires no authentication and uses predictable session IDs in URLs. Multiple public exploit scripts are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions after 6.00.00
Vendor Advisory: https://www.nec.com/en/global/security/
Restart Required: Yes
Instructions:
1. Contact NEC support for updated firmware. 2. Backup current configuration. 3. Apply firmware update. 4. Restart the PBX system. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Isolation
allRestrict access to the WebPro interface to trusted networks only
Configure firewall rules to block external access to WebPro ports (typically 80/443)
Session Management Controls
allImplement additional session validation and monitoring
Configure web server to log all session ID access attempts
Implement IP-based session validation if supported
🧯 If You Can't Patch
- Isolate the PBX system on a separate VLAN with strict access controls
- Implement network monitoring for unusual session ID patterns and access attempts
🔍 How to Verify
Check if Vulnerable:
Access the WebPro interface and check if session IDs in URLs follow predictable patterns or if version is 6.00.00Check Version:
Check WebPro interface login page or system information page for version numberVerify Fix Applied:
After patching, verify that session IDs are no longer predictable and that the version has been updated📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with sequential session IDs
- Access to Home.htm?sessionId= with unusual patterns
- Successful logins from unexpected IP addresses
Network Indicators:
- HTTP requests with predictable session ID patterns
- Unusual traffic to WebPro interface from external sources
SIEM Query:
source="webpro_logs" AND (uri="*Home.htm?sessionId=*" AND NOT user_agent="*normal_browser*" OR uri="*sessionId=*" AND status=200 AND user="*")🔗 References
- http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
- http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html
- http://seclists.org/fulldisclosure/2018/Dec/1
- https://www.exploit-db.com/exploits/45942/
- http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
- http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html
- http://seclists.org/fulldisclosure/2018/Dec/1
- https://www.exploit-db.com/exploits/45942/
