full-disclosure - RoomWizard Default Password and Sync Connector Credential Leak [CVE-2010-0214]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BLU141-W3316B1E9FFE0B76FBADC90CF0A0@phx.gbl>
Date: Thu, 6 Jan 2011 04:12:26 +0000
From: Sean Lam <seansec@...e.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: RoomWizard Default Password and Sync Connector
 Credential Leak [CVE-2010-0214]


*******************************************************************************
% Advisory Name: RoomWizard Default Password and Sync Connector Credential Leak
% Date: 2010-08-16
% Appliance/SW: RoomWizard Web-based room scheduling system
% Versions: Tested on Firmware 3.2.3 (Model RW10)
% Author: Sean Lam < seansec (at) live (d0t) com >
% Vendor Status: Vendor Contacted
% CVE Candidate: CVE-2010-0214
% Reference: n/a

*******************************************************************************


% Vulnerability Overview
************************

The RoomWizard Web based scheduling system with touch screen display uses a
default password: "roomwizard" which would allow remote attackers to obtain
console access at http://DeviceIP:80

Various configuration items can be tampered with once authenticated.


Additionally, a GET request on http://DeviceIP:80/admin/sign/DeviceSynch
will result in a leakage of the Sync Connector username and password on two
input boxes (password masked via type = password):

.....type="text" name="connectorusername" value="DOMAIN/DOMAINID"></td>

.....type="password" name="connectorpassword" value="DOMAINIDPASS"></td>



% Vendor Response & Timeline
****************************
2010-08-17    CERT/CC contacted for CVE Identifier Resvn (CVE-2010-0214)
        CERT/CC Vuln Tracking number VU#870601
2010-08-18    Vulnerability reported to CERT/CC and escalated to vendor
2010-12-21    CERT/CC informs vendor has fixed issue with latest patch



% Recommendations
************************
Apply latest patch released by vendor

 		 	   		  
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/