CVE-2018-15555

9.8 criticalEPSS 3.0%

On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onboard UART headers.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-662
Published: 2019-06-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

actiontec:web6000q_firmware

References

http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2019/Jun/1
http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2019/Jun/1

Check your stack JSON