PT-2017-12827

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.2 Description The issue concerns a buffer over-read in the telnet parser, specifically in the telnet parse function within print-telnet.c. This could allow a remote attacker to obtain sensitive information by...

PT-2017-2899 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. B versions through FW208WWb02 Description: The issue is related to a hardcoded password for the Alphanetworks account, which is set to wrgac25 dlink.2013gui dir850l upon device reset. This allows remote attackers to obtai...

Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Hardcoded Password Vulnerability

The Medfusion 4000 Wireless Syringe Infusion Pump is a syringe infusion pump deployed in healthcare and public health for delivering small doses of medication in acute care settings. The Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump is vulnerable to a hard-coded password...

PT-2017-3788

Name of the Vulnerable Software and Affected Versions coTURN versions prior to 4.5.0.9 Description The issue is related to an error in encoding registration data in the coTURN server function. This can allow a remote attacker to gain administrator access to the server via the telnet port. The TUR...

China Mobile and Routing App has ftp backdoor vulnerability

China Mobile He-Route APP is a cell phone supporting service software for He-Route. A ftp backdoor vulnerability exists in the China Mobile He-Route APP. The vulnerability is caused by writing ftp account passwords into the application. An attacker can use the vulnerability to obtain ftp account...

PT-2017-3366

Name of the Vulnerable Software and Affected Versions Zivif PR115-204-P-RS versions prior to a version with a fixed password for the root user Description The issue is related to the use of hardcoded credentials, specifically a password cat1029 for the root user, which cannot be changed due to th...

Telnet Credential Leak Reinforces Bleak State of IoT Security

Shortly after the Mirai attacks, Johannes Ullrich of the SANS Internet Storm Center ISC decided to try a little experiment. He put a security camera DVR online—a poorly secured one with default credentials—and observed how long it would take to become infected, and how often. He wasn’t...

Race is On To Notify Owners After Public List of IoT Device Credentials Published

Researchers are in a full-out sprint to notify the owners of a substantial list of connected devices and associated telnet credentials that has been available on Pastebin since June but gone viral since Thursday when it was posted on Twitter. The list has more than 20,000 views as of Saturday...

Code injection

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection...

CVE-2015-7258

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection...

CVE-2015-7258

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection...

CVE-2015-7258

CVE-2015-7258 affects ZTE ADSL ZXV10 W300 modems (W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57). The CNVD/NVD entries describe an information-disclosure flaw where remote authenticated users can obtain user passwords by displaying user information in a Telnet connection. The root cause detai...

CVE-2015-7258: Undefined Security Weakness

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection...

PT-2017-7170

Name of the Vulnerable Software and Affected Versions ZTE ADSL ZXV10 W300 modems versions W300V2.1.0f ER7 PE O57 through W300V2.1.0h ER7 PE O57 Description The issue allows remote authenticated users to obtain user passwords by displaying user information in a Telnet connection. Recommendations F...

[SECURITY] Fedora 25 Update: curl-7.51.0-9.fc25

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 26 Update: curl-7.53.1-10.fc26

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Design/Logic Flaw

DISPUTED An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed. NOTE: the vendor reports that the maximum possible damage is a communication failure. Also, only Sunny...

CVE-2017-9851

CVE-2017-9851 affects SMA Solar Technology Sunny Explorer; vulnerability arises when nonsense data is sent or a TELNET session is opened to the Sunny Explorer database port, causing the application to crash. Affected products/versions include Sunny Boy TLST-21 and TL-21, and Sunny Tripower TL-10 ...

CVE-2017-9851

An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed. NOTE: the vendor reports that the maximum possible damage is a communication failure. Also, only Sunny Boy...

CVE-2017-9851

An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed. NOTE: the vendor reports that the maximum possible damage is a communication failure. Also, only Sunny Boy...