Asante FM2008 Managed Ethernet Switch Default Backdoor Account Vulnerability

Bugtraq ID:	11947
Class:	Design Error
CVE:	CVE-2004-1320
Remote:	Yes
Local:	No
Published:	Dec 15 2004 12:00AM
Updated:	Jul 24 2009 10:06PM
Credit:	Joe Philipps <[email protected]> disclosed this vulnerability.
Vulnerable:	Asante FM2008 Managed Ethernet Switch v01.06
Not Vulnerable:	Asante FM2008 Managed Ethernet Switch v01.07

Asante FM2008 Managed Ethernet Switch Default Backdoor Account Vulnerability

Asante FM2008 managed Ethernet switches contain a default backdoor account vulnerability.

Attackers with network access to the telnet port of affected devices may gain administrative access by using the default credentials. Note that these credentials aren't usable in the web administration interface, but only in the telnet or serial interfaces.

Asante FM2008 v01.06 switches are vulnerable; other devices may be vulnerable as well.

Asante FM2008 Managed Ethernet Switch Default Backdoor Account Vulnerability

An exploit is not required.

Asante FM2008 Managed Ethernet Switch Default Backdoor Account Vulnerability

Solution:
Reports indicate that firmware version 1.07 resolves this issue. Please see the references for more information.

Asante FM2008 Managed Ethernet Switch Default Backdoor Account Vulnerability

References:

• FM2008 Product Page (Asante)
  
• Asante FM2008 10/100 Ethernet switch backdoor login (Joe Philipps )
  
• Re: Asante FM2008 10/100 Ethernet switch backdoor login ([email protected])