CVE-2018-18376: Orange Airbox Firmware

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.

Affected products

• Orange Airbox Firmware: version y858_fl_01.16_04 only

Published 2018-10-16. Last modified 2026-06-17.