Raidsonic IB-NAS5220 / IB-NAS4220-B XSS / Authentication Bypass

Device Name: IB-NAS5220 / IB-NAS4220-B Vendor: Raidsonic ============ Vulnerable Firmware Releases: ============ Product Name IB-NAS5220 / IB-NAS4220-B Tested Firmware IB5220: 2.6.3-20100206S Tested Firmware IB4220: 2.6.3.IB.1.RS.1 Firmware Download:...

Raidsonic NAS Devices Unauthenticated Remote Command Execution

Different Raidsonic NAS devices are vulnerable to OS command injection via the web interface. The vulnerability exists in timeHandler.cgi, which is accessible without authentication. This module has been tested with the versions IB-NAS5220 and IB-NAS4220. Since this module is adding a new user an...

Authentication flaw

userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-7081

userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-7081

The CVE-2008-7081 entry concerns RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1. The described vulnerability allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. This is a network-accessible issue with complete confidentiality...

CVE-2008-7081

userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-7081: Improper Authentication

userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-1431

RaidSonic NAS-4220-B with 2.6.0-n2007-10-11 firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key...

Design/Logic Flaw

RaidSonic NAS-4220-B with 2.6.0-n2007-10-11 firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key...

CVE-2008-1431

RaidSonic NAS-4220-B with 2.6.0-n2007-10-11 firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key...

CVE-2008-1431

CVE-2008-1431 affects RaidSonic NAS-4220-B with firmware 2.6.0-n (2007-10-11). The vulnerability stems from storing the partition encryption key in an unencrypted /system/.crypt file, encoded with base64, enabling local users to obtain the key. Impact is limited to local access exposure of the en...

CVE-2008-1431: Undefined Security Weakness

RaidSonic NAS-4220-B with 2.6.0-n2007-10-11 firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key...

raidsonic nas-4220 crypt disk key leak (stored in plain on unencrypted partition)

Manufacturer: RaidSonic www.raidsonic.de Device: NAS-4220-B Firmware: 2.6.0-n2007-10-11 Device Type: end user grade NAS box OS: Linux 2.6.15 Architecture: ARM Designed by: Storm Semiconductor Inc www.storlinksemi.com Problem: Hard disk encryption key stored in plain on unencrypted partition. Time...

Raidsonic nas-4220 weak cryptography

Encryption key is stored with data...

raidsonic-disclose.txt

Manufacturer: RaidSonic www.raidsonic.de Device: NAS-4220-B Firmware: 2.6.0-n2007-10-11 Device Type: end user grade NAS box OS: Linux 2.6.15 Architecture: ARM Designed by: Storm Semiconductor Inc www.storlinksemi.com Problem: Hard disk encryption key stored in plain on unencrypted partition. Time...