GSA Bounty: SSH server compatible with several vulnerable cryptographic algorithms

An ssh-audit scan found that ssh.fr.cloud.gov supports sha1 for various purposesincluding exclusively for MAC addresses, as well as arcfour. Both of these are outdated and known vulnerable. The algorithms used are also indicative of an outdated SSH version OpenSSH 6 or Dropbear 2013. It's probabl...

CVE-2018-6825

An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access...

Hardcoded credentials

An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access...

CVE-2018-6825

An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access...

CVE-2018-6825

CVE-2018-6825 : Affected product is VOBOT CLOCK devices running versions prior to 0.99.30. The vulnerability arises from an SSH server that ships with a hardcoded root-level vobot user account/password, enabling full root access. This enables remote compromise with no user interaction. According ...

CVE-2018-6825: Use of Hard-coded Credentials

An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access...

PT-2018-17761

Name of the Vulnerable Software and Affected Versions VOBOT CLOCK versions prior to 0.99.30 Description An issue was discovered where an SSH server exists with a hardcoded vobot account that has root access. Recommendations For versions prior to 0.99.30, update to version 0.99.30 or later to...

PT-2018-19356

Уязвимость SSH-сервера операционной системы ОС РОСА КОБАЛЬТ связана с использованием слабых алгоритмов шифрования таких как RC4 и Blowfish. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обходить криптографические механизмы защиты...

OpenSSH Process Open Buffer Overflow DoS

The vulnerability of the processopen function in sftp-server.c, a component of the OpenSSH cryptographic security tool, is related to an error in the “read-only” mode of operation. Exploiting this vulnerability could allow a malicious actor to cause service failures by creating files with zero...

borgbackup -- remote users can override repository restrictions

BorgBackup reports: Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers. A user able to access a remote Borg SSH server is able to circumvent access controls post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases 1.0.x...

Design/Logic Flaw

A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server...

CVE-2017-12084

A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server...

CVE-2017-12084

A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server...

CVE-2017-12084

Circle with Disney firmware 2.0.1 has a backdoor via its remote control (rclient) functionality. CVE-2017-12084 can be triggered by a specific set of network packets to remotely start an SSH server (Dropbear) on the device, creating a persistent backdoor. Exploitation path involves the Apid remot...

CVE-2017-12084: Missing Authorization

A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server...

PT-2017-12345

Name of the Vulnerable Software and Affected Versions Circle with Disney version 2.0.1 Description A backdoor issue exists in the remote control functionality, allowing an attacker to send a specific set of network packets to remotely start an SSH server on the device. This results in a persisten...

Circle with Disney Rclient SSH Persistent Remote Access Vulnerability

Summary A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker send an API call to enable the SSH server. Tested...

P4wnP1: A Open Source USB Attack Platform

PenTestIT RSS Feed As of now, hardware security projects seem to be attracting me more than software based projects. Evidently, I wrote a few posts covering them - List of Portable Hardware Devices for Penetration Testing, List of Raspberry Pi DIY Projects for Anonymity, etc. among other awesome...

OpenSSH < 7.6

According to its banner, the version of OpenSSH running on the remote host is prior to 7.6. It is, therefore, affected by a file creation restriction bypass vulnerability related to the 'processopen' function in the file 'sftp-server.c' that allows authenticated users to create zero-length files...

Highly Customizable Raspberry Pi USB Attack Platform: P4wnP1

P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W required for HID backdoor. Introduction the Windows LockPicker unlock Windows boxes with weak passwords, fully automated by attaching P4wnP1 the HID covert channel backdoor Get remote...