PT-2005-1549 · Thomson · Thomson Tcw690

Murdok · Published 2005-02-21 · Updated 2017-07-11 · CVE-2005-0494

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Thomson TCW690 cable modem firmware 2.1 and software ST42.03.0a

Description The issue concerns the RgSecurity form in the HTTP server, which fails to properly validate the password before making changes. This allows remote attackers on the LAN to gain access via a direct POST request to the / endpoint, although the specific endpoint is not mentioned.

Recommendations For firmware 2.1 and software ST42.03.0a, consider restricting access to the RgSecurity form in the HTTP server until a patch is available. As a temporary workaround, limit LAN access to the HTTP server to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-0494

Affected Products

Thomson Tcw690

References · 5

• 🔥 https://exploit-db.com/exploits/829 · Exploit
• http://secunia.com/advisories/14353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0494 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19387 · Note
• http://marc.info/?l=bugtraq&m=110886937131507&w=2 · Note