Summary
This host is running Datum Systems Satellite Modem and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow remote attackers to trivially gain privileged access to the device, execute arbitrary commands and gain access to arbitrary files.
Impact Level: System/Application
Solution
No solution or patch is available as of 30th January, 2015. Information regarding this issue will be updated once the solution details are available.
For updates refer to http://www.datumsystems.com/products
Insight
- The FTP service being enabled by default without authentication mechanisms.
This may allow a remote attacker to gain access to potentially sensitive information.
- The admin user account has a password of 'admin', which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the SnIP operating system.
Affected
Datum Systems PSM-4500 and PSM-500 series satellite modem
Detection
Send a crafted default credential via HTTP GET request and check whether it is able to login or not.
References
Severity
Classification
-
CVE CVE-2014-2950, CVE-2014-2951 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities