{"id":"CVE-2017-16886","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-16886","generatedAt":"2026-10-28T22:13:50.843Z","title":"Unauthorized Access to Web Services via CSRF can result in an unauthorized change of username or password of the administrator of the portal.","description":"The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access to Web Services via CSRF can result in an unauthorized change of username or password of the administrator of the portal.","published":"2018-01-12T17:29:01.000Z","lastModified":"2026-06-17T01:10:06.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-352"],"affected":["fiberhome/lm53q1 firmware"],"epss":{"score":0.07113,"percentile":0.94211,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.09695,"percentile":0.95354},{"date":"2026-09-22","score":0.07113,"percentile":0.93958}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2018-01-08","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":43460,"kind":"exploit","title":"FiberHome LM53Q1 - Multiple Vulnerabilities","url":"https://www.exploit-db.com/exploits/43460","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/hardware/webapps/43460.py","file":"exploits/hardware/webapps/43460.py","published":"2018-01-08","added":"2018-01-08","updated":"2018-01-08","author":"Ibad Shah","type":"webapps","platform":"hardware","port":null,"verified":false,"codes":["CVE-2017-16887","CVE-2017-16886","CVE-2017-16885"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"A public exploit is published in Exploit-DB and the impact is high, while EPSS rates exploitation at 7.1%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use."},"changes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Jan/28","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/43460/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2018/Jan/28","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/43460/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-16886","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}