Philips VOIP841 DECT Phone Multiple Security Vulnerabilities
BID:27790
Info
Philips VOIP841 DECT Phone Multiple Security Vulnerabilities
| Bugtraq ID: | 27790 |
| Class: | Unknown |
| CVE: |
CVE-2008-4875 CVE-2008-4874 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 14 2008 12:00AM |
| Updated: | Jul 06 2016 02:17PM |
| Credit: | Luca "ikki" Carettoni is credited with discovering these vulnerabilities. |
| Vulnerable: |
Philips Electronics VOIP841 DECT Phone 1.0.4.80 Philips Electronics VOIP841 DECT Phone 1.0.4.50 |
| Not Vulnerable: | |
Discussion
Philips VOIP841 DECT Phone Multiple Security Vulnerabilities
The Philips VOIP841 DECT phone is prone to multiple security vulnerabilities, including a hidden administration account, a cross-site scripting issue, and multiple information-disclosure issues.
Attackers can leverage these issues to bypass authentication mechanisms, execute arbitrary script code in the browser of an unsuspecting user in the context of an affected site, steal cookie-based authentication credentials, or obtain sensitive information that may aid in launching further attacks.
Some of these issues require user authentication. Note that attackers may use the hidden administration account to bypass authentication.
Philips VOIP841 phones with firmware 1.0.4.50 or 1.0.4.80 and Web Server 1.5 are affected.
The Philips VOIP841 DECT phone is prone to multiple security vulnerabilities, including a hidden administration account, a cross-site scripting issue, and multiple information-disclosure issues.
Attackers can leverage these issues to bypass authentication mechanisms, execute arbitrary script code in the browser of an unsuspecting user in the context of an affected site, steal cookie-based authentication credentials, or obtain sensitive information that may aid in launching further attacks.
Some of these issues require user authentication. Note that attackers may use the hidden administration account to bypass authentication.
Philips VOIP841 phones with firmware 1.0.4.50 or 1.0.4.80 and Web Server 1.5 are affected.
Exploit / POC
Philips VOIP841 DECT Phone Multiple Security Vulnerabilities
Attackers can exploit these issues with readily available network utilities. To exploit the cross-site scripting vulnerability, an attacker must entice an unsuspecting victim into following a URI.
Attackers can exploit these issues with readily available network utilities. To exploit the cross-site scripting vulnerability, an attacker must entice an unsuspecting victim into following a URI.
Solution / Fix
Philips VOIP841 DECT Phone Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Philips VOIP841 DECT Phone Multiple Security Vulnerabilities
References:
References:
- Philips VOIP841 Product Page (Philips Electronics)
- Vendor Website (Philips Electronics)
- Philips VOIP841 Multiple Vulnerabilities ([email protected])
- Re: Philips VOIP841 Multiple Vulnerabilities ([email protected])