Security readout for executives and security teams
Plain-English summary
Actiontec WCB6200Q devices before firmware 1.1.10.20a can create predictable admin login cookies. An attacker who can reach the management interface may hijack an admin session, take control of the device, and potentially add a hidden or secondary SSID as a network backdoor.
Executive priority
Prioritize remediation if these extenders are still deployed, because compromise could give an attacker administrative control over network access. This is most urgent in shared, guest, or poorly segmented wireless environments.
Technical view
The session cookie is reportedly derived from time of day rounded to 10ms. Because the web server returns its current time in responses, an attacker can search nearby possible session values until a valid admin session is found. The source bundle names only Actiontec WCB6200Q before 1.1.10.20a.
Likely exposure
Exposure is limited to Actiontec WCB6200Q devices running firmware earlier than 1.1.10.20a. Risk is highest where the admin web interface is reachable by untrusted LAN or Wi-Fi users. The sources do not establish WAN exposure or other affected products.
Exploitation context
The CVE description supports session hijacking and resulting admin control. KEV status is false in the provided bundle, and no cited source states active exploitation in the wild. Public exploit availability is not established here.
Researcher notes
The source bundle provides a clear weakness description but lacks CVSS, CWE, exploit telemetry, and detailed vendor advisory content beyond firmware reference. Scope should remain limited to WCB6200Q before 1.1.10.20a unless additional vendor evidence is obtained.
Mitigation direction
- Upgrade WCB6200Q firmware to 1.1.10.20a or later where available.
- Restrict admin interface access to trusted management networks only.
- Disable or remove unexpected secondary SSIDs after remediation.
- Rotate device admin credentials after firmware update and configuration review.
- Check Actiontec support guidance for current firmware or replacement options.
Validation and detection
- Inventory Actiontec WCB6200Q devices and record firmware versions.
- Confirm no device is running firmware earlier than 1.1.10.20a.
- Review wireless settings for unauthorized or unfamiliar SSIDs.
- Verify management interfaces are not reachable from untrusted networks.
- Check logs or configuration history for unexplained admin changes, if available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10252 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://actiontecsupport.zendesk.com/hc/en-us/articles/115000432163-WCB6200Q-Firmware-UpgradeCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.