CVE-2005-3718

Affected product: UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6. Vulnerability details: The device does not allow users to disable access to (1) SNMP or (2) rlogin on TCP 513, enabling remote attackers to trigger other vulnerabilities (e.g., CVE-2005-3716) or exe...

CVE-2005-3721

CVE-2005-3721 concerns the Hitachi IP5000 VOIP WIFI Phone (firmware 1.5.6) where the HTTP server’s default configuration does not require authentication for sensitive configuration pages. This allows remote attackers to modify device configuration without credentials. The available references con...

PT-2005-4471 · Wind River +1 · Vxworks +2

Name of the Vulnerable Software and Affected Versions: UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 Description: The issue concerns hard-coded public credentials in the SNMP daemon that cannot be changed, allowing attackers to obtain sensitive information...

CVE-2005-3723: Undefined Security Weakness

Hitachi IP5000 VOIP WIFI Phone 1.5.6 does not allow the user to disable access to 1 SNMP or 2 TCP port 3390, which allows remote attackers to modify configuration using CVE-2005-3722, or access the Unidata Shell to obtain sensitive information or cause a denial of service...

CVE-2005-3716: Use of Hard-coded Credentials

The SNMP daemon in UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 has hard-coded public credentials that cannot be changed, which allows attackers to obtain sensitive information...

CVE-2005-3717: Undefined Security Weakness

The telnet daemon in UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 has a default username "target" and password "password", which allows remote attackers to gain full access to the system...

CVE-2005-3718: Undefined Security Weakness

UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 does not allow users to disable access to 1 SNMP or 2 the rlogin port TCP 513, which allows remote attackers to exploit other vulnerabilities such as CVE-2005-3716, or execute arbitrary shell commands via rlogin, whic...

CVE-2005-3724: Exposure of Sensitive Information to an Unauthorized Actor

Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocumented and does not require authentication...

CVE-2005-3719: Undefined Security Weakness

Hitachi IP5000 VOIP WIFI Phone 1.5.6 has a hard-coded administrator password of "0000", which allows attackers with physical access to obtain sensitive information and modify the phone's configuration...

CVE-2005-3720: Undefined Security Weakness

The default index page in the HTTP server in Hitachi IP5000 VOIP WIFI Phone 1.5.6 lists sensitive information such as software versions...

CVE-2005-3722: Undefined Security Weakness

The SNMP v1/v2c daemon in Hitachi IP5000 VOIP WIFI Phone 1.5.6 allows remote attackers to gain read or write access to system configuration using arbitrary SNMP credentials...

CVE-2005-3721: Undefined Security Weakness

The default configuration of the HTTP server in Hitachi IP5000 VOIP WIFI Phone 1.5.6 does not require authentication for sensitive configuration pages, which allows remote attackers to modify configuration...

CVE-2005-3715: Undefined Security Weakness

Senao SI-680H Wireless VoIP Phone Firmware 0.03.0839 leaves the VxWorks debugger UDP port 17185 available without authentication, which allows attackers to access the phone OS, obtain sensitive information, and cause a denial of service...

[Full-disclosure] Hitachi IP5000 VoIP Wifi phone multiple vulnerabilities

I disclosed today the following vulnerabilities at the 32nd CSI conference in Washington, D.C. https://www.cmpevents.com/CSI32/a.asp?option=G&V=3&id=406438 Thanks, Shawn Merdinger =============================================================== VENDOR: Hitachi PRODUCT: Hitachi IP5000 VOIP WIFI Pho...

[Full-disclosure] Zyxel P2000W (Version1) VoIP Wifi phone multiple vulnerabilties

I disclosed today the following vulnerabilities at the 32nd CSI conference in Washington, D.C. https://www.cmpevents.com/CSI32/a.asp?option=G&V=3&id=406438 Thanks, Shawn Merdinger =============================================================== VENDOR: Zyxel PRODUCT: Zyxel P2000W Version 1 VOIP WI...

Cisco Security Advisory: Fixed SNMP Communities and Open UDP Port in Cisco 7920 Wireless IP Phone

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Fixed SNMP Communities and Open UDP Port in Cisco 7920 Wireless IP Phone Document ID: 68179 Advisory ID: cisco-sa-20051116-7920 http://www.cisco.com/warp/public/707/cisco-sa-20051116-7920.shtml Revision 1.0 For Public Release...

Fixed SNMP Communities and Open UDP Port in Cisco 7920 Wireless IP Phone

...

CVE-2003-1268

Multiple SQL injection vulnerabilities in 1 addcustomer.asp, 2 addprod.asp, and 3 process.asp in a.shopKart 2.0.3 allow remote attackers to execute arbitrary SQL and obtain sensitive information via the zip, state, country, phone, and fax parameters...

vxworks ftpd buffer overflow

It might be possible to make the remote FTP server crash by issuing this command : CEL aaaa...aaaa This problem is similar to the 'aix ftpd' overflow but on embedded vxworks based systems like the 3com nbx IP phone call manager and seems to cause the server to crash. Note that OpenVAS solely reli...

vxworks ftpd buffer overflow Denial of Service

It was possible to make the remote host crash by issuing this FTP command : CEL aaaa...aaaa This problem is similar to the 'aix ftpd' overflow but on embedded vxworks based systems like the 3com nbx IP phone call manager and seems to cause the server to crash. OpenVAS Vulnerability Test $Id:...