Security readout for executives and security teams
Plain-English summary
This CVE describes a router flaw that could let an attacker trick an Orange Livebox into placing outbound phone calls. The business concern is toll fraud, abuse of phone service, and operational disruption for sites still using this specific device and firmware family.
Executive priority
Prioritize if the organization still uses these Livebox devices for voice service. The issue is not shown as actively exploited, but it can create direct financial exposure through unauthorized calls and should be removed from supported environments.
Technical view
Orange Livebox 00.96.320S devices expose CSRF-prone cgi-bin/autodialing.exe and cgi-bin/phone_test.exe functions. The reported impact is arbitrary outbound telephone calls to attacker-specified numbers. The CVE links this to specific firmware, boot, modem, hardware, and Arcadyan identifiers.
Likely exposure
Exposure appears limited to Orange Livebox 00.96.320S devices matching the listed firmware and hardware identifiers. Risk depends on whether a user browser can reach the router management interface and whether the device still provides connected telephone service.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Public references include a security article and a GitHub repository, so technical details may be public, but active exploitation is not established by the provided sources.
Researcher notes
The CVE record lacks CVSS, CWE, CPE, and explicit patch status. Affected-product metadata is sparse, so validation should rely on the detailed firmware and hardware strings in the description rather than broad product assumptions.
Mitigation direction
- Inventory for affected Orange Livebox 00.96.320S devices and matching firmware identifiers.
- Check Orange or device-provider guidance for fixed firmware, replacement, or decommissioning options.
- Restrict router administration access to trusted networks and authorized administrators only.
- Review telephone billing and call records for unexplained outbound calls.
- Retire unsupported affected devices where vendor remediation is unavailable.
Validation and detection
- Confirm device model, firmware, boot, modem, hardware, and Arcadyan identifiers against the CVE description.
- Verify whether router management pages are reachable from user workstations or untrusted networks.
- Review call logs and provider billing for unexplained outbound telephone activity.
- Check vendor or ISP support channels for current remediation status.
- Document whether the affected telephony functions are enabled or business-required.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-20576 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://gbhackers.com/orange-adsl-modems/CVE reference · x_refsource_MISC
- https://github.com/zadewg/LIVEBOX-0DAYCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.