PT-2006-1990 · Thomson · Thomson Speedtouch

Publicado 2006-03-01 · Atualizado 2011-03-08 · CVE-2006-0947

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Thomson SpeedTouch modem version 5.3.2.6.0

Description The issue allows remote attackers to create users that cannot be deleted via scripting code in the 31 parameter in a NewUser function. This function is not filtered by the modem when creating the account, but the created users cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface.

Recommendations For Thomson SpeedTouch modem version 5.3.2.6.0, as a temporary workaround, consider restricting the use of the NewUser function until a patch is available. Additionally, avoid using the 31 parameter in the affected function to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-0947

Produtos afetados

Thomson Speedtouch

Referências · 8

• 🔥 https://exploit-db.com/exploits/27319 · Exploit
• 🔥 http://securityfocus.com/bid/16839 · Exploit
• 🔥 http://securityfocus.com/archive/1/426186 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0947 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0947 · Nota de Segurança
• http://secunia.com/advisories/19069 · Nota
• http://vupen.com/english/advisories/2006/0765 · Nota
• http://securitytracker.com/id?1015688 · Nota