Novatel Wireless MiFi Mobile Hotspot Multiple Remote Vulnerabilities
BID:37830
Info
Novatel Wireless MiFi Mobile Hotspot Multiple Remote Vulnerabilities
| Bugtraq ID: | 37830 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 15 2010 12:00AM |
| Updated: | Jan 15 2010 12:00AM |
| Credit: | Adam Baldwin |
| Vulnerable: |
Novatel Wireless MiFi 0 |
| Not Vulnerable: | |
Discussion
Novatel Wireless MiFi Mobile Hotspot Multiple Remote Vulnerabilities
Novatel Wireless MiFi is prone to multiple remote security vulnerabilities, including lack of authentication, an input-validation issue, cross-site request forgery, and an information-disclosure weakness.
An attacker can exploit these issues to gain administrative access to the affected device, change configuration settings, potentially execute arbitrary commands, and obtain users' geographic location.
Novatel Wireless MiFi is prone to multiple remote security vulnerabilities, including lack of authentication, an input-validation issue, cross-site request forgery, and an information-disclosure weakness.
An attacker can exploit these issues to gain administrative access to the affected device, change configuration settings, potentially execute arbitrary commands, and obtain users' geographic location.
Exploit / POC
Novatel Wireless MiFi Mobile Hotspot Multiple Remote Vulnerabilities
Attackers can use readily available tools to exploit these issues. To exploit some of these issues, an attacker must entice an unsuspecting user into visiting a malicious webpage.
Attackers can use readily available tools to exploit these issues. To exploit some of these issues, an attacker must entice an unsuspecting user into visiting a malicious webpage.
Solution / Fix
Novatel Wireless MiFi Mobile Hotspot Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Novatel Wireless MiFi Mobile Hotspot Multiple Remote Vulnerabilities
References:
References:
- MiFi GeoPwn (evilpacket)
- Novatel Wireless Homepage (Novatel Wireless)
- Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker (Adam Baldwin