PT-2006-1445 · Advantage Century Telecommunication+1 · Act P202S Ip Phone+1

Published 2006-01-22 · Updated 2017-07-20 · CVE-2006-0374

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Advantage Century Telecommunication (ACT) P202S IP Phone version 1.01.21

Description The issue concerns the presence of undocumented ports that could allow remote attackers to access sensitive information, reflect network data, or gain unauthorized access. Specifically, the VxWorks WDB remote debugging ONCRPC (wdbrpc) on UDP 17185 might allow attackers to obtain sensitive data, such as memory contents and internal operating-system data. Additionally, the echo service on TCP 7 could be used to reflect network data, and the rlogin service on TCP 513 might permit access without authentication.

Recommendations For Advantage Century Telecommunication (ACT) P202S IP Phone version 1.01.21, consider disabling the undocumented ports, specifically the VxWorks WDB remote debugging ONCRPC on UDP 17185, the echo service on TCP 7, and the rlogin service on TCP 513, to prevent potential exploitation until a patch or official fix is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2006-0374

Affected Products

Act P202S Ip Phone

Vxworks

References · 5

• http://secunia.com/advisories/18514 · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041434.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0374 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24149 · Note
• http://securityfocus.com/bid/16288 · Note