PT-2005-2585 · Psoft · H-Sphere Winbox

Published 2005-05-16 · Updated 2017-07-11 · CVE-2005-1606

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions H-Sphere Winbox versions 2.4.2 through 2.4.3 RC1

Description The issue allows local users to gain privileges by accessing sensitive information stored in plaintext in world-readable log files. This information includes username and password.

Recommendations For versions 2.4.2 and 2.4.3 RC1, consider restricting access to the log files to prevent unauthorized users from reading sensitive information. As a temporary workaround, restrict write access to the log files to minimize the risk of exposing sensitive data.

Exploit

Fix

Related Identifiers

CVE-2005-1606

Affected Products

H-Sphere Winbox

References · 8

• 🔥 http://securityfocus.com/bid/13559 · Exploit
• 🔥 http://exploitlabs.com/files/advisories/EXPL-A-2005-007-hsphere.txt · Exploit
• 🔥 https://exploit-db.com/exploits/25636 · Exploit
• http://secunia.com/advisories/15287 · Patch
• http://psoft.net/misc/hsphere_winbox_security_update_passwd.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-1606 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20522 · Note
• http://osvdb.org/16239 · Note