Polycom ViewStation Null Default Password Vulnerability

Bugtraq ID:	5631
Class:	Configuration Error
CVE:	CVE-2002-0626
Remote:	Yes
Local:	No
Published:	Sep 04 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Discovery of this issue is credited to Jeff Horne of the ISS X-Force.
Vulnerable:	Polycom ViewStation V.35 7.2 Polycom ViewStation V.35 6.5.1 Polycom ViewStation SP/SP384 7.2 Polycom ViewStation SP/SP384 6.5.1 Polycom ViewStation MP 7.2 Polycom ViewStation MP 6.5.1 Polycom ViewStation H.323 7.2 Polycom ViewStation H.323 6.5.1 Polycom ViewStation FX/VS 4000 4.1.5 Polycom ViewStation DCP 7.2 Polycom ViewStation DCP 6.5.1 Polycom ViewStation 512 7.2 Polycom ViewStation 512 6.5.1 Polycom ViewStation 128 7.2 Polycom ViewStation 128 6.5.1
Not Vulnerable:	Polycom ViewStation FX/VS 4000 4.2

Polycom ViewStation Null Default Password Vulnerability

Polycom ViewStation comes configured with a null value for the default password. Users of the ViewStation are not prompted to change the password to a non-default value during installation. Some users may not be aware that there is no password, which may potentially expose the device to compromise.

Polycom ViewStation Null Default Password Vulnerability

There is no exploit required.

Polycom ViewStation Null Default Password Vulnerability

Solution:
This issue has been addressed in ViewStation FX/VS4000 4.2. Fixes for other products are scheduled for later release. Those affected by this issue should contact the vendor about obtaining fixes.

Polycom ViewStation Null Default Password Vulnerability

References:

• Multiple Remote Vulnerabilities in Polycom Videoconferencing Products (Internet Security Systems )
  
• Polycom Worldwide Resource Center (Polycom)