Hard-coded credentials and command-injection vulnerabilities on BigPond 3G21WB
==============================================================================
[ADVISORY INFORMATION]
Title: Hard-coded credentials and command-injection vulnerabilities
on BigPond 3G21WB
Discovery date: 17/09/2012
Release date: 11/10/2012
Credits: Roberto Paleari (roberto () greyhats it, @rpaleari)
[VULNERABILITY INFORMATION]
Class: Authentication bypass, command-injection
[AFFECTED PRODUCTS]
We confirm the following device models to be affected:
* BigPond 3G21WB
Similar routers are probably vulnerable to these very same issues.
[VULNERABILITY DETAILS]
The firmware running on the affected routers is subject to multiple security
issues that allow an unauthenticated attacker to gain administrative access to
the device and execute arbitrary commands. In the following paragraphs we
describe the details of the vulnerabilities we identified.
a) Hard-coded credentials
A user can authenticate to the web server running on the device using the
credentials "Monitor:bigpond1". These credentials are hard-coded, and cannot
be changed...
Leggi il seguito »
- Articolo precedente: Apple – Samsung: un rapporto destinato a peggiorare?
- Articolo successivo: Celebriamo l’impresa di Felix Baumgartner con un fantastico sfondo per l’iPhone 5
SEGNALA / INVIA QUESTO POST:
Hai trovato questo articolo interessante? Iscriviti GRATIS ai nostri feeds!
