CVE-2018-13862: Trivum WebTouch Setup authentication reset via unauthenticated GET request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, a public exploit, and very high EPSS probability make this an urgent pre-auth takeover risk for exposed devices.

What it is

Trivum WebTouch Setup V9 (V2.53 build 13163, FW 303) exposes an XML endpoint that lets an unauthenticated remote attacker disable access protection by sending a crafted GET request to /xml/system/setAttribute.xml with id=0&attr=protectAccess&newValue=0. Once protection is turned off, the attacker can log in without authorization, effectively bypassing authentication on the device's setup interface.

Impact

An attacker gains full unauthenticated access to the WebTouch Setup interface, allowing them to log in without credentials and take over device configuration. The CVSS vector rates confidentiality, integrity and availability impact as high, so the attacker can read, alter or disrupt the system.

Attack surface

Reachable over the network through the web interface's XML endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description confirm no authentication or user interaction is required. Any host that can reach the device's HTTP service can trigger the request.

Exploitation

A public Exploit-DB entry (45063) exists and EPSS reports a 30-day probability of about 0.51 (98.9th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the vendor firmware update referenced in the Trivum advisory (update.trivum.com/update/tp9-changes.html) as the primary fix.
• If patching is not immediately possible, restrict network access to the WebTouch Setup interface to trusted management hosts only, using firewall rules or VLAN segmentation.
• Disable or block external exposure of the device's HTTP management service until the fix is applied.
• Monitor vendor advisories for updated firmware and verify the installed build is later than V2.53 build 13163 (FW 303).

Detection

• Search web/proxy logs for GET requests to /xml/system/setAttribute.xml containing attr=protectAccess and newValue=0.
• Alert on any access to /xml/system/setAttribute.xml from untrusted or unexpected source IPs.
• Monitor for authentication state changes or logins to the WebTouch Setup interface that occur without a preceding legitimate authentication event.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.