CVE-2013-0137

The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session...

Code injection

The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files...

CVE-2013-0137

Summary (CVE-2013-0137) The Digital Alert Systems DASDEC‑I/II and Monroe Electronics R189 One‑Net EAS devices released before firmware version 2.0‑2 contained a publicly available private SSH key in firmware, enabling remote attackers with SSH access to log in as root and spoof alerts. The issue ...

CVE-2013-4733

The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files...

CVE-2013-4734

CVE-2013-4734 affects the DASDEC EAS device (Digital Alert Systems) before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2. The underlying issue is that dasdec_mkuser generates predictable passwords, which could allow an attacker to obtain non-administrative access via unspe...

CVE-2013-4732

The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU662676...

CVE-2013-4733

The CVE-2013-4733 entry affects the web server component of the Digital Alert Systems DASDEC EAS device and the Monroe Electronics R189 One-Net EAS device, both versions prior to 2.0-2. An attacker can remotely read log files to obtain sensitive configuration and status information, exposing conf...

CVE-2013-4735

The CVE-2013-4735 issue affects the Digital Alert Systems DASDEC EAS device prior to 2.0-2 and Monroe Electronics R189 One-Net EAS prior to 2.0-2, which have a default administrative password. The underlying risk is that an attacker could remotely obtain access over an IP network due to this defa...

CVE-2013-4732

CVE-2013-4732 affects Digital Alert Systems DASDEC EAS device (versions 2.0-2) and Monroe Electronics R189 One-Net EAS device (versions 2.0-2). The issue is predictable session ID values in the administrative web server, enabling potential session hijacking by sniffing the network. Public documen...

PT-2013-5167

Name of the Vulnerable Software and Affected Versions Digital Alert Systems DASDEC EAS device versions prior to 2.0-2 Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2 Description The issue generates predictable passwords, which might make it easier for attackers to obtain...

PT-2013-5166

Name of the Vulnerable Software and Affected Versions Digital Alert Systems DASDEC EAS device versions prior to 2.0-2 Monroe Electronics R189 One-Net EAS device versions prior to 2.0-2 Description The issue allows remote attackers to obtain sensitive configuration and status information by readin...

Monroe Electronics DASDEC Compromised Root SSH Key

OVERVIEW This advisory provides mitigation details for a vulnerability that impacts the Monroe Electronics DASDEC. Mike Davis, a researcher with IOActive, reported a compromised root SSH key vulnerability to CERT Coordination Center CERT/CC. This vulnerability is in Monroe Electronics DASDEC‑I an...