3Com OfficeConnect Wireless Cable/DSL Gateway 'SaveCfgFile' Access Validation Vulnerability

Bugtraq ID:	33686
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 09 2009 12:00AM
Updated:	Feb 10 2009 03:48PM
Credit:	Luca Carettoni
Vulnerable:	3Com OfficeConnect Wireless 11g Cable/DSL Gateway 1.2
Not Vulnerable:

3Com OfficeConnect Wireless Cable/DSL Gateway 'SaveCfgFile' Access Validation Vulnerability

The 3Com OfficeConnect Wireless Cable/DSL Gateway is prone to an access-validation vulnerability because of a lack of authentication when users access specific administration applications.

Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

The 3Com OfficeConnect Wireless Cable/DSL Gateway firmware 1.2.0 is vulnerable; other versions may also be affected.

3Com OfficeConnect Wireless Cable/DSL Gateway 'SaveCfgFile' Access Validation Vulnerability

Attackers can exploit this issue using readily available networking utilities.

3Com OfficeConnect Wireless Cable/DSL Gateway 'SaveCfgFile' Access Validation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

3Com OfficeConnect Wireless Cable/DSL Gateway 'SaveCfgFile' Access Validation Vulnerability

References:

• OfficeConnect Wireless 11g Cable/DSL Gateway Homepage (3Com)
  
• 3Com OfficeConnect Wireless Cable/DSL Router Authentication Bypass ([email protected])