CVE-2018-9112
📋 TL;DR
This vulnerability affects Foxconn FEMTO AP-FC4064-T access points with firmware AP_GT_B38_5.8.3lb15-W47 LTE Build 15. Attackers can gain administrative privileges by exploiting weak default credentials (admin/admin) and cookie manipulation in the web management interface. Organizations using these devices are at risk of complete device compromise.
💻 Affected Systems
- Foxconn FEMTO AP-FC4064-T
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative control of the access point, allowing network traffic interception, device reconfiguration, installation of malicious firmware, and use as a pivot point into internal networks.
Likely Case
Unauthorized administrative access leading to network disruption, data interception, and potential lateral movement within the network.
If Mitigated
Limited impact if strong authentication is enforced and web management is disabled or restricted.
🎯 Exploit Status
Exploitation requires low-privilege admin access first, then cookie manipulation for privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Follow workarounds and mitigation steps below.
🔧 Temporary Workarounds
Change Default Credentials
allImmediately change the default admin password to a strong, unique password.
Disable Web Management Interface
allDisable the web management interface if not required, or restrict access to trusted IPs only.
🧯 If You Can't Patch
- Isolate affected devices in a separate network segment with strict firewall rules.
- Implement network monitoring for unusual authentication attempts or configuration changes.
🔍 How to Verify
Check if Vulnerable:
Check if device model is Foxconn FEMTO AP-FC4064-T with firmware version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 and test if default admin/admin credentials work.Check Version:
Check web interface or device console for firmware version information.Verify Fix Applied:
Verify that default credentials no longer work and that strong authentication is enforced.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful admin login
- Unusual configuration changes from admin account
Network Indicators:
- Unauthorized access to web management port (typically 80/443)
- Traffic patterns indicating device reconfiguration
SIEM Query:
source="ap_logs" AND (event="login_success" AND user="admin") OR (event="config_change" AND user="admin")