PolyVision RoomWizard insecurely stores Sync Connector Active Directory credentials and uses default administrative password

Overview The PolyVision RoomWizard web based scheduling system with touch screen display contains two vulnerabilities that allow an unauthorized user to access the device console and Sync Connector Active Directory credentials. Description The PolyVision RoomWizard is a touch screen scheduling...

RoomWizard Credential Disclosure

% Advisory Name: RoomWizard Default Password and Sync Connector Credential Leak % Date: 2010-08-16 % Appliance/SW: RoomWizard Web-based room scheduling system % Versions: Tested on Firmware 3.2.3 Model RW10 % Author: Sean Lam % Vendor Status: Vendor Contacted % CVE Candidate: CVE-2010-0214 %...