# CVE-2018-13109: ADB broadband gateways - Information Disclosure

> Live exploitation tracking for CVE-2018-13109 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2018-13109

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** ADB Global broadband gateways
- **Weaknesses:** CWE-863 (Incorrect Authorization)
- **Tags:** firewall, iot

## Description

All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerability where attackers are able to access and manipulate settings within the web interface that are forbidden to end users (e.g., by the ISP). An attacker would be able to enable the TELNET server or other settings as well.

## CrowdSec analysis

[CVE-2018-13109](https://euvd.enisa.europa.eu/vulnerability/CVE-2018-13109) is an authorization bypass vulnerability affecting all ADB broadband gateways and routers based on the Epicentro platform. This flaw allows attackers to access and modify restricted settings in the web interface, such as enabling the TELNET server, potentially leading to unauthorized configuration changes and increased risk of further exploitation.

CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2018-13109 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by inserting a double slash (`//`) before restricted entries in URLs under `/ui/dboard/settings/management/`, such as `/ui/dboard/settings/management//telnetserver`, to bypass authorization controls and gain unauthorized access to sensitive configuration settings.

## Timeline

- 2018-07-06: CVE Published. CVE-2018-13109 is published to NVD.
- 2025-09-10: Rule Released. CrowdSec releases a rule to detect CVE-2018-13109 exploitation attempts against the CrowdSec Network.

## References

- http://packetstormsecurity.com/files/148429/ADB-Authorization-Bypass.html
- http://seclists.org/fulldisclosure/2018/Jul/18
- https://www.sec-consult.com/en/blog/advisories/authorization-bypass-in-all-adb-broadband-gateways-routers/
- https://gitlab.com/exploit-database/exploitdb/blob/main/exploits/hardware/webapps/44982.txt

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2018-13109) follows observed exploitation activity for CVE-2018-13109. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.