PT-2010-4044 · S2 Security · S2 Security Netbox

Published 2010-06-25 · Updated 2017-08-17 · CVE-2010-2468

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions S2 Security NetBox versions 2.x through 3.x

Description The issue concerns the use of a weak hash algorithm for storing the Administrator password. This weakness makes it easier for attackers to obtain privileged access by recovering the cleartext of the password.

Recommendations For versions 2.x through 3.x, consider changing the Administrator password to a strong, unique password and avoid using the same password across multiple systems until a stronger hash algorithm is implemented. As a temporary workaround, restrict access to the Administrator account to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-2468

Affected Products

S2 Security Netbox

References · 6

• 🔥 http://blip.tv/file/3414004 · Exploit
• 🔥 http://slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2468 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59827 · Note
• http://darkreading.com/blog/archives/2010/04/attacking_door.html · Note
• http://securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2 · Note