Hardcoded credentials

Secure Elements Class 5 AVR server aka C5 EVM before 2.8.1 uses a hard-coded user ID and password, which allows remote attackers to gain access to the server...

Hardcoded credentials

iOpus Secure Email Attachments SEA, probably 1.0, does not properly handle passwords that consist of repetitions of a substring, which allows attackers to decrypt files by entering only the substring...

Hardcoded credentials

Control cards for Cisco Optical Networking System ONS 15000 series nodes before 20060405 allow remote attackers to cause a denial of service card reset via 1 a "crafted" IP packet to a device with secure mode EMS-to-network-element access, aka bug ID CSCsc51390; 2 a "crafted" IP packet to a devic...

Hardcoded credentials

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the...

CVE-2006-0375

Advantage Century Telecommunication ACT P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol NTP server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks...

Hardcoded credentials

Advantage Century Telecommunication ACT P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol NTP server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks...

CVE-2006-0375

The CVE-2006-0375 entry applies to Advantage Century Telecommunication (ACT) P202S IP Phone, running firmware 1.1.21 on VxWorks. The issue is a hardcoded NTP server (Taiwan) that could let an attacker supply false time, block time information, or perform related attacks. The available connected d...

CVE-2006-0375: Undefined Security Weakness

Advantage Century Telecommunication ACT P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol NTP server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks...

CVE-2005-3725

Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 uses hardcoded IP addresses for its DNS servers, which could allow remote attackers to cause a denial of service or hijack Zyxel phones by attacking or spoofing the hardcoded DNS servers. NOTE: it could be argued that this issue reflects an inherent...

CVE-2005-3725

Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 uses hardcoded IP addresses for its DNS servers. This can let remote attackers cause a denial of service or hijack Zyxel phones by attacking or spoofing those hardcoded DNS servers. The issue is described in CVE-2005-3725; exploitation details are n...

CVE-2004-2557

CVE-2004-2557 affects NetGear WG602 (WG602v1) Wireless Access Point 1.7.14, which contains a hardcoded admin account: username "superman" and password "21241036". This permits remote configuration changes by an attacker. Connected documents confirm the concrete details; exploitation status and fi...

CVE-2004-2556

NetGear WG602 aka WG602v1 Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "5777364", which allows remote attackers to modify the configuration...

CVE-2004-2556

CVE-2004-2556 affects NetGear WG602 (WG602v1) Wireless Access Point firmware 1.04.0 and 1.5.67, which contain a hardcoded administrator account (username: super, password: 5777364). This flaw allows remote attackers to modify the device configuration. The issue is rooted in a hardcoded credential...

CVE-2004-2557

NetGear WG602 aka WG602v1 Wireless Access Point 1.7.14 has a hardcoded account of username "superman" and password "21241036", which allows remote attackers to modify the configuration...

CVE-2005-3725

Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 uses hardcoded IP addresses for its DNS servers, which could allow remote attackers to cause a denial of service or hijack Zyxel phones by attacking or spoofing the hardcoded DNS servers. NOTE: it could be argued that this issue reflects an inherent...

CVE-2005-3725: Undefined Security Weakness

Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 uses hardcoded IP addresses for its DNS servers, which could allow remote attackers to cause a denial of service or hijack Zyxel phones by attacking or spoofing the hardcoded DNS servers. NOTE: it could be argued that this issue reflects an inherent...

CVE-2004-2557: Undefined Security Weakness

NetGear WG602 aka WG602v1 Wireless Access Point 1.7.14 has a hardcoded account of username "superman" and password "21241036", which allows remote attackers to modify the configuration...

CVE-2004-2556: Undefined Security Weakness

NetGear WG602 aka WG602v1 Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "5777364", which allows remote attackers to modify the configuration...

[Full-disclosure] Hitachi IP5000 VoIP Wifi phone multiple vulnerabilities

I disclosed today the following vulnerabilities at the 32nd CSI conference in Washington, D.C. https://www.cmpevents.com/CSI32/a.asp?option=G&V=3&id=406438 Thanks, Shawn Merdinger =============================================================== VENDOR: Hitachi PRODUCT: Hitachi IP5000 VOIP WIFI Pho...

[Full-disclosure] Zyxel P2000W (Version1) VoIP Wifi phone multiple vulnerabilties

I disclosed today the following vulnerabilities at the 32nd CSI conference in Washington, D.C. https://www.cmpevents.com/CSI32/a.asp?option=G&V=3&id=406438 Thanks, Shawn Merdinger =============================================================== VENDOR: Zyxel PRODUCT: Zyxel P2000W Version 1 VOIP WI...