[Full-disclosure] Senao SI-680H VoIP Wifi phone undocumented open port

I disclosed today the following vulnerability at the 32nd CSI conference in Washington, D.C. https://www.cmpevents.com/CSI32/a.asp?option=G&V=3&id=406438 Thanks, Shawn Merdinger =============================================================== VENDOR: Senao VENDOR NOTIFIED: 28 June, 2005 VENDOR...

Senao SI-680H wirieless Wi-Fi VoIP phones unauthorized access

VxWorks debugger is available with UDP/17185...

Cisco Security Advisory: Fixed SNMP Communities and Open UDP Port in Cisco 7920 Wireless IP Phone

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Fixed SNMP Communities and Open UDP Port in Cisco 7920 Wireless IP Phone Document ID: 68179 Advisory ID: cisco-sa-20051116-7920 http://www.cisco.com/warp/public/707/cisco-sa-20051116-7920.shtml Revision 1.0 For Public Release...

CVE-2002-2148

Lucent Ascend MAX Router 5.0 and earlier, Lucent Ascend Pipeline Router 6.0.2 and earlier and Lucent DSLTerminator allows remote attackers to obtain sensitive information such as hostname, MAC, and IP address of the Ethernet interface via a discard UDP port 9 packet, which causes the device to le...

CVE-2002-2138

HP Advance Server/9000 on HP-UX 11.00 or 11.11 is affected by CVE-2002-2138. A malformed UDP packet to port 139 can cause a remote DoS (panic) in B.04.05–B.04.09. The connected sources do not provide exploitation details or a remediation. Monitoring for updates is advised.

CVE-2002-2150

Technical details for CVE-2002-2150 are not publicly available in the provided connected documents. The materials reproduce the description but do not specify affected products, versions, root cause, or remediation. Monitor for updates.

CVE-2002-2137

GlobalSunTech Wireless Access Points 1 WISECOM GL2422AP-0T, and possibly OEM products such as 2 D-Link DWL-900AP+ B1 2.1 and 2.2, 3 ALLOY GL-2422AP-S, 4 EUSSO GL2422-AP, and 5 LINKSYS WAP11-V2.2, allow remote attackers to obtain sensitive information like WEP keys, the administrator password, and...

CVE-2002-2138

RFC-NETBIOS in HP Advanced Server/9000 B.04.05 through B.04.09, when running HP-UX 11.00 or 11.11, allows remote attackers to cause a denial of service panic via a malformed UDP packet on port 139...

Fixed SNMP Communities and Open UDP Port in Cisco 7920 Wireless IP Phone

...

CVE-2002-2133

Telindus 1100 ASDL router running firmware 6.0.x uses weak encryption for UDP session traffic, which allows remote attackers to gain unauthorized access by sniffing and decrypting the administrative password...

CVE-2002-2133

CVE-2002-2133 describes a vulnerability in Telindus 1100 ADSL router firmware 6.0.x where weak encryption is used for UDP session traffic. This weakness could allow remote attackers to gain unauthorized access by sniffing and decrypting the administrative password. Documents do not provide remedi...

CVE-2002-2137: Undefined Security Weakness

GlobalSunTech Wireless Access Points 1 WISECOM GL2422AP-0T, and possibly OEM products such as 2 D-Link DWL-900AP+ B1 2.1 and 2.2, 3 ALLOY GL-2422AP-S, 4 EUSSO GL2422-AP, and 5 LINKSYS WAP11-V2.2, allow remote attackers to obtain sensitive information like WEP keys, the administrator password, and...

CVE-2002-2138: Undefined Security Weakness

RFC-NETBIOS in HP Advanced Server/9000 B.04.05 through B.04.09, when running HP-UX 11.00 or 11.11, allows remote attackers to cause a denial of service panic via a malformed UDP packet on port 139...

CVE-2002-2150: Undefined Security Weakness

Firewalls from multiple vendors empty state tables more slowly than they are filled, which allows remote attackers to flood state tables with packet flooding attacks such as 1 TCP SYN flood, 2 UDP flood, or 3 Crikey CRC Flood, which causes the firewall to refuse any new connections...

CVE-2002-2148: Undefined Security Weakness

Lucent Ascend MAX Router 5.0 and earlier, Lucent Ascend Pipeline Router 6.0.2 and earlier and Lucent DSLTerminator allows remote attackers to obtain sensitive information such as hostname, MAC, and IP address of the Ethernet interface via a discard UDP port 9 packet, which causes the device to le...

CVE-2002-2133: Undefined Security Weakness

Telindus 1100 ASDL router running firmware 6.0.x uses weak encryption for UDP session traffic, which allows remote attackers to gain unauthorized access by sniffing and decrypting the administrative password...

Snort <= 2.4.2 Back Orifice Pre-Preprocessor Remote Exploit (4)

Exploit for linux platform in category remote exploits =============================================================== Snort hey xwings 03:07 why don't you come up and see me sometime? Tested on : Linux debian24 2.4.27-2-386 1 Mon May 16 16:47:51 JST 2005 i686 GNU/Linux gcc version 3.3.5 Debian...

Snort 2.4.2 - Back Orifice Pre-Preprocessor Remote (3)

Snort 2.4.2 - Back Orifice Pre-Preprocessor Remote 3 / snort 2.4.0 - 2.4.2 Back Orifice Pre-Preprocessor Remote Exploit by Russell Sanford [email protected] - www.code-junkies.net include include include include include include include include include include define buffsize 1056 define COOKIE...

Linux Kernel 2.6.x - Sysctl Unregistration Local Denial of Service

Linux Kernel 2.6.x - Sysctl Unregistration Local Denial of Service / source: https://www.securityfocus.com/bid/15365/info Linux Kernel is reported prone to a local denial-of-service vulnerability. This issue arises from a failure to properly unregister kernel resources when network devices are...

CVE-2005-3493

Battle Carry .005 and earlier allows remote attackers to cause a denial of service inaccessible port via a large packet, which triggers a socket error and terminates the socket that is listening on the server's UDP port...