CVE-2018-16201 json
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may a…
published 2019-01-09 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-8054
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on the same network segment to login to the administrators settings screen and change the configuration or execute arbitrary OS commands.
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 8.3 | AV:A/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Toshiba Lighting & Technology Corporation Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
Classification
- Weakness
-
- CWE-798 Use of Hard-coded Credentials
References
-
tlt.co.jp
/tlt/information/seihin/notice/defect/20181219/20181219.htm
vendor-advisory
-
jvn.jp
/en/jp/JVN99810718/index.html
third-party-advisory
Sources
- CVE List CVE-2018-16201
- NVD CVE-2018-16201
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.