CVE-2018-18871: Gigasetpro Maxwell Basic Firmware

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).

Affected products

• Gigasetpro Maxwell Basic Firmware: version 2.22.7 only

Published 2018-12-20. Last modified 2026-06-17.