EE's vulnerability footprint centers on a narrow set of mobile broadband and networking devices, primarily its 4GEE product line and related firmware, with recurring exposure across web-interface and credential-management weaknesses including cross-site request forgery, cross-site scripting, hard-coded credentials, and improper permission assignment. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ee over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-14327HIGH The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions (Everyone:Full Contro | Sep 26, 2018 | 7.8 | 37 | NO | YES |
CVE-2018-10532HIGH An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70_E1_02.00_19 devices. Hardcoded root SSH credentials were discovered to be stored within the "core_app" binary utilised by the | Oct 30, 2018 | 8.8 | 28 | NO | NO |
CVE-2017-14269CRITICAL EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content. | Sep 11, 2017 | 9.8 | 28 | NO | NO |
CVE-2017-14267HIGH EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, goform/setReset, and gofor | Sep 11, 2017 | 8.8 | 25 | NO | NO |
CVE-2017-14268MEDIUM EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have XSS in the sms_content parameter in a getSMSlist request. | Sep 11, 2017 | 6.1 | 20 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ee.
Media articles that mention a CVE ID that affects a product developed by Ee — matched by CVE ID, not by vendor name.