PT-2001-2518 · Alcatel · Alcatel Speed Touch

Published 2001-04-10 · Updated 2017-07-11 · CVE-2001-1425

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Alcatel Speed Touch firmware KHDSAA.108 Alcatel Speed Touch firmware KHDSAA.132 through KHDSAA.134

Description The challenge-response authentication mechanism for the EXPERT user in Alcatel Speed Touch devices is susceptible to an issue that allows remote attackers to gain privileges. This is achieved by directly computing the response based on information provided by the device during the login process.

Recommendations For firmware KHDSAA.108, update to a version that addresses this issue. For firmware KHDSAA.132 through KHDSAA.134, update to a version that addresses this issue. As a temporary workaround, consider restricting access to the EXPERT user account until a patch is available.

Fix

Related Identifiers

CVE-2001-1425

Affected Products

Alcatel Speed Touch

References · 7

• http://securityfocus.com/bid/2568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1425 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6354 · Note
• http://kb.cert.org/vuls/id/243592 · Note
• http://security.sdsc.edu/self-help/alcatel/alcatel-bugs.html · Note
• http://cert.org/advisories/CA-2001-08.html · Note
• http://securityfocus.com/archive/1/175229 · Note