Soti Pocket Controller-Professional Remote Command Execution Vulnerability

Bugtraq ID:	15775
Class:	Access Validation Error
CVE:	CVE-2005-4152
Remote:	Yes
Local:	No
Published:	Dec 08 2005 12:00AM
Updated:	Feb 07 2006 08:55PM
Credit:	Discovered by Jonathan Read and Seth Fogie.
Vulnerable:	Soti Pocket Controller-Professional 5.0
Not Vulnerable:	Soti Pocket Controller-Professional 5.05

Soti Pocket Controller-Professional Remote Command Execution Vulnerability

Soti Pocket Controller-Professional is prone to a remote command-execution vulnerability. Successful exploitation could allow an attacker to cause a hard reset of the device, resulting in a loss of data and installed applications.

Pocket Controller-Professional v5 is vulnerable; other versions may also be affected.

Soti Pocket Controller-Professional Remote Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Soti Pocket Controller-Professional Remote Command Execution Vulnerability

Solution:

The vendor has released version 5.05 to address this issue. Contact the vendor for details on obtaining the appropriate update.

Soti Pocket Controller-Professional Remote Command Execution Vulnerability

References:

• Pocket Controller-Professional (Soti)
  
• Airscanner Mobile Security Advisory: Remote Hard Reset Data Wipe and DoS of Pock ([email protected])
  
• Re: Airscanner Mobile Security Advisory: Remote Hard Reset Data ([email protected])