lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 7 Jan 2018 03:15:38 +0500
From: Ibad Shah <muhammad.ibad.shah@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] FiberHome MIFI LM53Q1 Multiple Vulnerabilities

SUMMARY


FiberHome Suffers from improper permission handling resulting in modification

of password, exposing sensitive details by unauthorized access.

DETAILS

The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38
uses SOAP based web services in order to interact with the portal.

Unauthorized Access to Web Services can result disclosure of sensitive
information for example users connected to the device,

Username & Password of Portal & vice versa.The Password or
Administrator ID of Portal can also

be changed via  crafted web service call due to unauthorized access to
web service.



REFERENCES


CVE-2017-16885, CVE-2017-16886, CVE-2017-16887


Credits


Taimoor Zafar, Aitezaz Mohsin, Jawad Ahmed

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists