CVE-2018-16705

9.8 criticalEPSS 1.6%

Critical (9.8) in furuno. EPSS 1.6% chance of exploitation in the next 30 days.

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2018-09-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

furuno:felcom_250_firmware
furuno:felcom_500_firmware

References

https://cyberskr.com/blog/furuno-felcom.html
https://gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31
https://cyberskr.com/blog/furuno-felcom.html
https://gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31

Check your stack JSON