CVE-2018-9160: SickRage returns cleartext credentials in HTTP responses

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network-reachable, unauthenticated credential exposure and a public exploit make this a critical fix-first item.

What it is

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses, exposing secrets to anyone who can read those responses. Because the credentials are transmitted and stored in the clear, they can be captured or reused to access the application.

Impact

An attacker who obtains the exposed credentials gains authenticated access to the SickRage instance and any credentials reused elsewhere. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any HTTP response that carries the credentials can be read by a network-positioned attacker or by anyone able to view the response.

Exploitation

Not listed in CISA KEV, but EPSS is 0.75602 (99.5th percentile) and a public Exploit-DB entry (44545) exists, indicating exploit code is available and exploitation is likely.

What to do

• Upgrade SickRage to v2018.03.09-1 or later, which contains the patch commit.
• If immediate upgrade is not possible, restrict network access to the SickRage interface to trusted hosts only.
• Rotate any credentials that may have been exposed in HTTP responses.
• Serve SickRage only over HTTPS and avoid reusing its credentials for other services.

Detection

• Inspect HTTP response bodies and logs for cleartext credential fields returned by SickRage.
• Monitor network traffic for credentials transmitted without TLS to or from SickRage hosts.
• Alert on authentication attempts using SickRage credentials from unexpected source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.