Security readout for executives and security teams
Plain-English summary
Certain Thomson cable gateway devices reportedly expose stored credentials through SNMP. If SNMP is reachable from an attacker-controlled network, credentials could be disclosed without normal login. The public record does not provide CVSS, vendor remediation, or confirmed exploitation evidence.
Executive priority
Prioritize this where legacy Thomson gateways remain deployed or internet-reachable. The business risk is credential leakage from network edge equipment, but urgency depends on confirmed device presence and SNMP exposure.
Technical view
CVE-2018-20394 covers Thomson DWG849, DWG850-4, DWG855, and TWG870 firmware versions listed in the CVE. The issue is credential discovery through specific SNMP OID requests. The sources identify affected firmware but do not document authentication requirements, patch status, or safe fixed versions.
Likely exposure
Exposure is most likely where affected Thomson gateway models have SNMP enabled and reachable from customer, WAN, management, or other untrusted networks. Organizations should prioritize externally exposed or shared-network devices first.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. The weakness is still sensitive because SNMP reachability may allow credential disclosure, but real-world exploit prevalence is not established by the cited sources.
Researcher notes
Evidence is sparse: the CVE names models, firmware, and SNMP credential disclosure, while references point to a sensitive OID list and related blog discussion. No CVSS, CWE, fixed version, or exploitation confirmation is provided in the source bundle.
Mitigation direction
- Identify affected Thomson models and firmware versions in network inventories.
- Restrict SNMP to trusted management networks only.
- Disable SNMP where it is not operationally required.
- Rotate credentials on affected devices after exposure is assessed.
- Check vendor or ISP guidance for fixed firmware or replacement options.
Validation and detection
- Confirm whether listed Thomson models exist in the environment.
- Verify firmware versions against the CVE-described affected versions.
- Review firewall and ACL rules for SNMP exposure paths.
- Check device configuration for SNMP enablement and community settings.
- Review logs or management telemetry for unexpected SNMP access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-20394 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csvCVE reference · x_refsource_MISC
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.