Vulnerability CVE-2017-6351
Published: 2017-03-05   Modified: 2017-03-06

Description:
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account. This account is not documented, nor is the DEBUG feature or the use of telnetd on port tcp/5885.

See advisories in our WLB2 database:
Topic
Author
Date
High
WePresent undocumented privileged manufacturer backdoor account
Quentin Olagne
01.03.2017

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Wepresent -> Wipg-1500 firmware 

 References:
http://www.securityfocus.com/bid/96588
http://www.wepresentwifi.com/
Copyright 2024, cxsecurity.com

 

Back to Top