CVE-2018-10990 : What You Need to Know

Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices have a vulnerability related to the logout function that could potentially lead to unauthorized access by attackers.

Understanding CVE-2018-10990

This CVE involves a security issue in Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices that affects the logout functionality.

What is CVE-2018-10990?

The logout function on these devices does not immediately invalidate all information stored on the device related to the "credential" cookie, potentially enabling unauthorized access within a limited timeframe.

The Impact of CVE-2018-10990

Attackers could exploit this vulnerability to gain unauthorized access to the device for a short period, even after a user logs out.
The logout feature primarily removes the cookie from a specific web browser instance, not all stored device information.

Technical Details of CVE-2018-10990

This section provides more technical insights into the vulnerability.

Vulnerability Description

The logout action does not immediately destroy all state related to the "credential" cookie, making it easier for attackers to access the device for a few minutes.

Affected Systems and Versions

Product: Arris Touchstone Telephony Gateway TG1682G 9.1.103J6
Vendor: Arris
Version: 9.1.103J6

Exploitation Mechanism

Attackers can exploit the incomplete logout process to gain unauthorized access to the device within a limited timeframe.

Mitigation and Prevention

Protecting against CVE-2018-10990 requires immediate actions and long-term security practices.

Immediate Steps to Take

Monitor device access closely to detect any unauthorized activities.
Consider changing default passwords and implementing strong authentication mechanisms.
Regularly clear browser cookies and cache to reduce the risk of unauthorized access.

Long-Term Security Practices

Conduct regular security audits and vulnerability assessments on the device.
Keep the device firmware and software up to date to patch known vulnerabilities.

Patching and Updates

Check for firmware updates from the vendor to address the logout vulnerability and apply them promptly.