JVN#42070907: Multiple SONY Videoconference Systems do not properly perform authentication

Multiple SONY Videoconference Systems have a default user account which does not require authentication to login to a device CWE-306. This user account has a privilege to view some of the system configuration files. As a result, the device may be manipulated by an attacker with administrative...

Multiple Sony IPELA Engine IP Cameras Remote Code Execution Vulnerabilities

IPELA Engine IP Cameras are IP camera products from Sony. An unspecified remote code execution vulnerability exists in IPELA Engine IP Cameras. An attacker could exploit this vulnerability to execute arbitrary code, and a failed attack attempt could trigger a denial of service condition...

On Backdoors in Sony's IP Cameras, a Linux Bug, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the latest Linux bug, Sony closing backdoors in cameras, and Google’s new open source fuzzer. Show notes: Sony Closes Backdoors in IP-Enabled Cameras Old Linux Kernel Code Execution Bug Patched Google Debuts Continuous Fuzzer for...

Sony IPELA Engine IP Cameras Backdoor Vulnerability (Dec 2016)

Sony IPELA Engine IP Camera devices are prone to a backdoor vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Sony IPELA Engine IP Camera Detection (HTTP)

HTTP based detection of Sony IPELA Engine IP Cameras. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Sony IPELA ENGINE IP Cameras Backdoor Accounts Vulnerability

Sony IPELA ENGINE IP Cameras contain multiple backdoors that, among other functionality, allow an attacker to enable the Telnet/SSH service for remote administration over the network. Other available functionality may have undesired effects to the camera image quality or other camera functionalit...

Backdoor Vulnerability in Multiple Sony IPELA ENGINE IP Cameras

SNC-CH115, SNC-CH120 and SNC-CH160 are IP camera products from Sony. A backdoor vulnerability exists in multiple Sony IPELA ENGINE IP Cameras. A remote attacker can exploit the vulnerabilities to remotely manage the camera using Telnet/SSH services to gain root access to the Linux shell, affectin...

Sony Closes Backdoors in IP-Enabled Cameras

Sony, in late November, provided a firmware update for a popular IP-enabled camera line used by enterprises and law enforcement alike that closed off remote administration backdoors. The backdoors could be abused to draft these devices into botnets or allow for manipulation of images and...

Sony IPELA ENGINE IP Cameras Backdoor Accounts

We have published an accompanying blog post to this technical advisory with further information: http://blog.sec-consult.com/2016/12/backdoor-in-sony-ipela-engine-ip-cameras.html SEC Consult Vulnerability Lab Security Advisory ======================================================================...

Multiple SONY network cameras vulnerable to sensitive information disclosure

Overview Multiple SONY network cameras contain a sensitive information disclosure vulnerability. SEC Consult reported this vulnerability to Sony, and Sony reported this vulnerability to JPCERT/CC to notify the solution to users through JVN. JPCERT/CC and Sony coordinated for the publication of th...

Sony Playstation 4 (PS4) 3.15 3.55 - WebKit Code Execution (PoC)

Sony Playstation 4 PS4 3.15 3.55 - WebKit Code Execution PoC PS4 3.55 Unsigned Code Execution ============== This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50 and 3.55. This Exploit, is based-off Henkaku'...

Sony Playstation 4 (PS4) 3.15 < 3.55 - WebKit Code Execution (PoC)

PS4 3.55 Unsigned Code Execution ============== This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50 and 3.55. This Exploit, is based-off Henkaku's WebKit Vulnerability for the Sony's PSVita. It includes bas...

Qualcomm Chip Flaw Leaves 900m Android Devices Open to Attack

Four vulnerabilities found in Qualcomm chips used in 900 million Android devices leave affected phones and tablets open to attacks that could give hackers complete system control. Researchers at Check Point who found the flaw are calling the vulnerability Quadrooter and say that a patch isn’t...

Warning! Over 900 Million Android Phones Vulnerable to New 'QuadRooter' Attack

Android has Fallen! Yet another set of Android security vulnerabilities has been discovered in Qualcomm chipsets that affect more than 900 Million Android smartphones and tablets worldwide. What's even worse: Most of those affected Android devices will probably never be patched. Dubbed...

blog.sony.com XSS vulnerability

Vulnerable URL: http://blog.sony.com//wp-includes/js/plupload/plupload.flash.swf?%target%g=alert%g=OPENBUGBOUNTY& Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

pro.sony.com XSS vulnerability

Vulnerable URL: https://pro.sony.com/bbsc/resellerSearchResults.do Details: Description| Value ---|--- Patched:| Yes, at 05.10.2017 Latest check for patch:| 05.10.2017 06:31 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

sonymusic.fr XSS vulnerability

Vulnerable URL: http://www.sonymusic.fr/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 02.08.2016 Latest check for patch:| 02.08.2016 16:14 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

blogs.sonymobile.com XSS vulnerability

Vulnerable URL: http://blogs.sonymobile.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 02.08.2016 Latest check for patch:| 02.08.2016 16:16 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

sonymobile.com XSS vulnerability

Vulnerable URL: http://www.sonymobile.com/gb/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 01.06.2016 Latest check for patch:| 01.06.2016 00:31 GMT Vulnerability type:| XSS Vulnerability status:| Publicl...

sonymusic.com XSS vulnerability

Vulnerable URL: http://www.sonymusic.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 02.08.2016 Latest check for patch:| 02.08.2016 16:14 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...