CVE-2017-8865: Exposure of Sensitive Information to an Unauthorized Actor

Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an attacker on the network to replay VoIP traffic between a Dino device and remote server to any other Dino device...

CVE-2017-8866: Use of a Broken or Risky Cryptographic Algorithm

Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a different Dino device to decrypt VoIP traffic between a child's Dino and remote server...

PT-2017-18591

Name of the Vulnerable Software and Affected Versions Elemental Path's CogniToys Dino smart toys versions 0.0.794 and earlier Description The issue allows a remote attacker to decrypt VoIP traffic between a child's Dino and a remote server by utilizing a different Dino device, due to the use of a...

Dasan Networks GPON ONT WiFi Router H64X Series System Config Download

Summary H64xx is comprised of one G-PON uplink port and four ports of Gigabit Ethernet downlink supporting 10/100/1000Base-T RJ45. It helps service providers to extend their core optical network all the way to their subscribers, eliminating bandwidth bottlenecks in the last mile. H64xx is...

Dasan Networks GPON ONT WiFi Router H64X Series Privilege Escalation

Vendor: Dasan Networks Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu Affected version: Model: H640GR-02 H640GV-03 H640GW-02 H640RW-02 H645G Firmware: 2.77-1115 2.76-9999 2.76-1101 2.67-1070 2.45-1045 Summary: H64xx is comprised of one G-PON uplink port and four port...

DblTek - Multiple Vulnerabilities

DblTek - Multiple Vulnerabilities Vulnerabilities summary The following advisory describes 2 two vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Ou...

Node.js VoIP penetration testing framework : Bluebox-ng

Bluebox-ng : Node.js VoIP penetration testing framework Features Auto VoIP/UC penetration test Report generation Performance RFC compliant SIP TLS and IPv6 support SIP over websockets and WSS support RFC 7118 SHODAN, exploitsearch.net and Google Dorks SIP common security tools scan,...

Multiple Cross-Site Request Forgery Vulnerabilities in D-Link DVG-5402SP VoIP Router

The D-Link DVG-5402SP VoIP is a wireless router product from AUO D-Link. The D-Link DVG-5402SP VoIP router suffers from multiple cross-site request forgery vulnerabilities that can be exploited by remote attackers to perform unauthorized operations...

CVE-2017-9478

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST and DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices sets the CM MAC address to a value with a two-byte offset from the MTA/VoIP MAC address, which indirectly allows remote...

Dasan Networks GPON ONT WiFi Router H64X Series System Config Download

Dasan Networks GPON ONT WiFi Router H64X Series System Config Download Vendor: Dasan Networks Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu Affected version: Models: H640GR-02 H640GV-03 H640GW-02 H640RW-02 H645G Firmware: 3.02p2-1141 2.77p1-1125 2.77-1115 2.76-9999...

Dasan Networks GPON ONT WiFi Router H64X Series - Configuration Download

Dasan Networks GPON ONT WiFi Router H64X Series - Configuration Download Dasan Networks GPON ONT WiFi Router H64X Series System Config Download Vendor: Dasan Networks Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu Affected version: Models: H640GR-02 H640GV-03 H640GW-...

Dasan Networks GPON ONT WiFi Router H64X Series - Authentication Bypass

Dasan Networks GPON ONT WiFi Router H64X Series - Authentication Bypass Dasan Networks GPON ONT WiFi Router H64X Series Authentication Bypass Vendor: Dasan Networks Product web page: http://www.dasannetworks.com | http://www.dasannetworks.eu Affected version: Model: H640GR-02 H640GV-03 H640GW-02...

Dasan Networks GPON ONT WiFi Router H64X Series Privilege Escalation

Summary H64xx is comprised of one G-PON uplink port and four ports of Gigabit Ethernet downlink supporting 10/100/1000Base-T RJ45. It helps service providers to extend their core optical network all the way to their subscribers, eliminating bandwidth bottlenecks in the last mile. H64xx is...

voipratetracker.com XSS vulnerability

Vulnerable URL: http://www.voipratetracker.com/redirect/top.php?out.%22%3EKeritzy%3Cimg%20src=x%20onerror=prompt%28/xssposed/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Security Flaws in 4G VoLTE

Research paper: "Subscribers remote geolocation and tracking using 4G VoLTE enabled Android phone," by Patrick Ventuzelo, Olivier Le Moal, and Thomas Coudray. Abstract: VoLTE Voice over LTE is a technology implemented by many operators over the world. Unlike previous 2G/3G technologies, VoLTE...

Peplink 7.0.0-build1904 XSS / CSRF / SQL Injection / File Deletion

X41 D-Sec GmbH Security Advisory: X41-2017-005 Multiple Vulnerabilities in peplink balance routers =================================================== Overview -------- Confirmed Affected Versions: 7.0.0-build1904 Confirmed Patched Versions:...

UBUNTU-CVE-2017-9359

The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted packet...

WolfSSL library X509 Certificate Text Parsing Code Execution Vulnerability

Summary An exploitable off-by-one write vulnerability exists in the x509 certificate parsing functionality of wolfSSL library versions up to 3.10.2. A specially crafted x509 certificate can cause a single out of bounds byte overwrite resulting in potential certificate validation vulnerabilities,...

StringBleed: SNMP Protocol“God mode”vulnerability affects a variety of network devices-vulnerability warning-the black bar safety net

Recently, data from South America, two security researchers discovered that the SNMP（Simple Network Management Protocol the v1 and v2 version of the Protocol the presence of the authorized authentication and access control bypass vulnerability, at least 78 kinds of models of network access and Io...

Multiple AVM FRITZ!Box VoIP Remote Code Execution

Several models of the AVM FRITZ!Box are vulnerable to a heap-based buffer overflow, which allows attackers to execute arbitrary code on the device. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...