CVE-2006-5038 - The FiWin SS28S WiFi VoIP SIP/Skype Phone, firmware version 01_02_07, has a hard-coded username and

CVE-2006-5038

Summary

The FiWin SS28S WiFi VoIP SIP/Skype Phone, firmware version 01_02_07, has a hard-coded username and password, which allows remote attackers to gain administrative access via telnet.

References

http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0391.html
http://secunia.com/advisories/22041
http://www.osnews.com/story.php/15923/Review-FiWin-SS28S-WiFi-VoIP-SIPSkype-Phone/
http://www.securityfocus.com/bid/20154
https://exchange.xforce.ibmcloud.com/vulnerabilities/29114

Vulnerable Configurations

cpe:2.3:h:fiwin:ss28s_wifi_voip_sip_skype_phone:2007-02-01:*:*:*:*:*:*:*
cpe:2.3:h:fiwin:ss28s_wifi_voip_sip_skype_phone:2007-02-01:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 20-07-2017 - 01:33)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	20154
fulldisc	20060921 FiWin SS28S WiFi VoIP SIP/Skype Phone Hardcoded Telnet user/pass and debug access
misc	http://www.osnews.com/story.php/15923/Review-FiWin-SS28S-WiFi-VoIP-SIPSkype-Phone/
secunia	22041
xf	fiwin-ss28s-default-account(29114)

Last major update

20-07-2017 - 01:33

Published

27-09-2006 - 23:07

Last modified

20-07-2017 - 01:33