CVE-2019-9534 The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to...

CVE-2019-9529 The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device...

PT-2019-19691 · Cobham · Cobham Explorer 710

Name of the Vulnerable Software and Affected Versions: Cobham EXPLORER 710 firmware version 1.07 Description: The issue concerns the lack of firmware image validation in the device. Development scripts that were left in the firmware can be exploited to upload a custom firmware image. This could...

Cobham EXPLORER 710 Multiple Security Vulnerabilities

Description Cobham EXPLORER 710 is prone to multiple security vulnerabilities: 1. Multiple security weaknesses 2. Multiple access-bypass vulnerabilities 3. An information-disclosure vulnerability 4. An arbitrary file upload vulnerability An attacker may exploit these issues to perform certain...

Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal

Overview CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. They discovered multiple new vulnerabilities affecting the device and the firmware, some of which could allow an unauthenticated, local attacker to gain access t...

CVE-2019-16320

Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community...

CVE-2019-16320

Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community...

Information disclosure

Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community...

CVE-2019-16320

Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community...

CVE-2019-16320

Cobham Sea Tel satellite terminals, models v170 224521 through v194 225444, are vulnerable to information disclosure via the public SNMP community, enabling potential exposure of vessel latitude/longitude. The root cause is exposure of SNMP read privileges to unauthenticated users. Exploitation d...

Cobham Satcom Sailor 250 and 500 Trust Management Vulnerabilities

The Cobham Satcom Sailor 250 and Cobham Satcom Sailor 500 are both shipboard maritime satellite broadband terminals from Cobham UK. A security vulnerability exists in the Cobham Satcom Sailor 250 and 500 using firmware versions prior to 1.25. A remote attacker could use this vulnerability to chan...

Cobham Satcom Sailor 800 and 900 Access Control Error Vulnerabilities

The Cobham Satcom Sailor 800 and Cobham Satcom Sailor 900 are both shipboard maritime satellite broadband terminals from Cobham UK. An access control error vulnerability exists in the Cobham Satcom Sailor 800 and 900. A remote attacker could exploit this vulnerability to write to the system's...

Cobham Satcom Sailor 800 and 900 Cross-Site Scripting Vulnerabilities

The Cobham Satcom Sailor 800 and Cobham Satcom Sailor 900 are both shipboard maritime satellite broadband terminals from Cobham UK. A cross-site scripting vulnerability exists in the Cobham Satcom Sailor 800 and 900. A remote attacker could exploit this vulnerability to inject arbitrary web scrip...

Cobham Satcom Sailor 250 and 500 Cross-Site Scripting Vulnerabilities

The Cobham Satcom Sailor 250 and Cobham Satcom Sailor 500 are both shipboard maritime satellite broadband terminals from Cobham UK. A cross-site scripting vulnerability exists in the Cobham Satcom Sailor 250 and 500 using firmware versions prior to 1.25. A remote attacker can exploit this...

Design/Logic Flaw

Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could b...

Cross site scripting

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field...

CVE-2018-19392

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...

CVE-2018-19393

Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could b...

Cross site scripting

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field e.g., Satellite name, and then restoring the...

CVE-2018-19394

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field e.g., Satellite name, and then restoring the...