RoomWizard Default Password Security Bypass And Information Disclosure Vulnerabilities
BID:45699
Info
RoomWizard Default Password Security Bypass And Information Disclosure Vulnerabilities
| Bugtraq ID: | 45699 |
| Class: | Design Error |
| CVE: |
CVE-2010-0214 CVE-2011-0423 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2011 12:00AM |
| Updated: | Apr 13 2015 09:05PM |
| Credit: | Sean Lam |
| Vulnerable: |
Interactive Media Link RoomWizard 0 |
| Not Vulnerable: | |
Discussion
RoomWizard Default Password Security Bypass And Information Disclosure Vulnerabilities
RoomWizard is prone to a security-bypass vulnerability and an information-disclosure vulnerability.
Successful exploiting these issues allow attackers to gain access to the application; other attacks may also be possible.
RoomWizard is prone to a security-bypass vulnerability and an information-disclosure vulnerability.
Successful exploiting these issues allow attackers to gain access to the application; other attacks may also be possible.
Exploit / POC
RoomWizard Default Password Security Bypass And Information Disclosure Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
RoomWizard Default Password Security Bypass And Information Disclosure Vulnerabilities
Solution:
Vendor patch is available. Please see the reference for more details.
Solution:
Vendor patch is available. Please see the reference for more details.
References
RoomWizard Default Password Security Bypass And Information Disclosure Vulnerabilities
References:
References:
- RoomWizard Default Password and Sync Connector Credential Leak [CVE-2010-0214] (Sean Lam)
- RoomWizard Homepage (Interactive Media Link)
- Vulnerability Note VU#870601 (US-CERT)