PT-2017-17016 · Wepresent · Wepresent Wipg-1500

Quentin Olagne · Publicado 2017-03-06 · Atualizado 2017-09-01 · CVE-2017-6351

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WePresent WiPG-1500 version 1.0.3.7

Description The issue concerns a hardcoded username and password for a manufacturer account. When the device is set to DEBUG mode, an attacker can use the telnet protocol to connect to the device and log in with the hardcoded abarco account credentials. This account and the DEBUG feature are not documented, and the use of telnetd on port tcp/5885 is also undisclosed.

Recommendations For WePresent WiPG-1500 version 1.0.3.7, as a temporary workaround, consider disabling the DEBUG mode to prevent unauthorized access until a patch is available. Restrict access to port tcp/5885 to minimize the risk of exploitation. Avoid using the hardcoded abarco account credentials in the affected device configuration until the issue is resolved.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-6351

Produtos afetados

Wepresent Wipg-1500

Referências · 5

• 🔥 https://exploit-db.com/exploits/41480 · Exploit
• https://osv.dev/vulnerability/CVE-2017-6351 · Aviso do Fabricante
• http://wepresentwifi.com · Aviso do Fabricante
• http://securityfocus.com/bid/96588 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6351 · Nota de Segurança