PT-2018-13694 · Furuno · Furuno Felcom

Cyberskr · Publicado 2018-09-10 · Atualizado 2019-10-03 · CVE-2018-16705

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FURUNO FELCOM versions 250 and 500

Description The issue allows unauthenticated access to the xml/permission.xml file, which contains system usernames and passwords, including Admin and Service user accounts with unsalted MD5 hashes, and the SMS server password in cleartext.

Recommendations For FURUNO FELCOM versions 250 and 500, restrict access to the xml/permission.xml file to prevent unauthorized access to sensitive system information. As a temporary workaround, consider disabling unauthenticated access to the device until a patch is available. Avoid using the device's default passwords and consider changing them to stronger, unique passwords.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-16705

Produtos afetados

Furuno Felcom

Referências · 3

• 🔥 https://cyberskr.com/blog/furuno-felcom.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16705 · Nota de Segurança
• https://gist.github.com/CyberSKR/c00eabd6b1d5603d724b615ab358ff31 · Nota