CVE-2018-18375: Orange Airbox Firmware

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.

Affected products

• Orange Airbox Firmware: version y858_fl_01.16_04 only

Published 2018-10-16. Last modified 2026-06-17.