PT-2005-4471 · Wind River+1 · Wind+2

Published 2005-11-21 · Updated 2024-02-13 · CVE-2005-3716

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6

Description The issue concerns hard-coded public credentials in the SNMP daemon that cannot be changed, allowing attackers to obtain sensitive information.

Recommendations For UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6, consider disabling the SNMP daemon until a patch is available to prevent exploitation of the hard-coded credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2005-3716

Affected Products

Utstarcom F1000 Voip Wifi Phone

Vxworks

Wind

References · 6

• http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038834.html · Vendor Advisory
• http://secunia.com/advisories/17629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3716 · Security Note
• http://vupen.com/english/advisories/2005/2472 · Note
• http://securityfocus.com/bid/15476 · Note
• https://t.me/cvenotify/71260 · Telegram Post