Multiple Vendors Multiple EAS Devices CVE-2013-4735 Insecure Default Password Vulnerability

Bugtraq ID:	60915
Class:	Configuration Error
CVE:	CVE-2013-4735
Remote:	Yes
Local:	No
Published:	Jun 26 2013 12:00AM
Updated:	Jun 26 2013 12:00AM
Credit:	Mike Davis and Cesar Cerrudo of IOActive
Vulnerable:	Monroe Electronics R189SE One-NetSE 0 Monroe Electronics R189 One-Net 0 Digital Alert Systems DASDEC-II 0 Digital Alert Systems DASDEC-I 0
Not Vulnerable:	Monroe Electronics R189SE One-NetSE 2.0-2 Monroe Electronics R189 One-Net 2.0-2 Digital Alert Systems DASDEC-II 2.0-2 Digital Alert Systems DASDEC-I 2.0-2

Multiple Vendors Multiple EAS Devices CVE-2013-4735 Insecure Default Password Vulnerability

Multiple Vendors Multiple EAS Devices are prone to an insecure-default-password vulnerability.

Remote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized administrative access to the device.

The following products are affected:

Digital Alert Systems DASDEC-I
Digital Alert Systems DASDEC-II
Monroe Electronics R189 One-Net
Monroe Electronics R189SE One-NetSE

Multiple Vendors Multiple EAS Devices CVE-2013-4735 Insecure Default Password Vulnerability

An attacker can exploit this issue using readily available tools.

Multiple Vendors Multiple EAS Devices CVE-2013-4735 Insecure Default Password Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Vendors Multiple EAS Devices CVE-2013-4735 Insecure Default Password Vulnerability

References:

• Digital Alert Systems Homepage (Digital Alert Systems)
  
• Digital Alert Systems Information for VU#662676 (CERT)
  
• Monroe Electronics Homepage (Monroe Electronics)
  
• Monroe Electronics Information for VU#662676 (CERT)
  
• Vulnerability Note VU#662676 (CERT)