Jimbecher

An issue in the Web Application of the CommScope Ruckus IoT Controller allows authenticated users to perform arbitrary read/write actions. The API endpoint allows an HTTP POST request to write arbitrary content into any file on the filesystem with root privileges.

An issue was discovered that involves Unauthenticated API Endpoints.

An issue was discovered where hard-coded API keys exist.

An issue was discovered where hard-coded web application administrator passwords exist for the `admin` and `nplus1user` accounts.

An issue was discovered that allows Directory Traversal through the API.

An issue was discovered that involves hard-coded system passwords, which provide shell access.

An issue exists in the CommScope Ruckus IoT Controller, where an undocumented backdoor allows shell access via a developer account. This backdoor enables unauthorized access, potentially leading to further exploitation.

The firmware of the Barco wePresent WiPG-1600W includes a hardcoded API account and password that can be discovered by inspecting the firmware image. This allows a malicious actor to use the password to access authenticated, administrative functions in the API.

🚨 CVE-2020-28334 Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28331 could potentially be used in a simple and automated exploit chain to go from unauthenticated remote attacker to root shell. 🎖@cveNotify

The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions, instead using a `SEID` token appended to URLs in GET requests. This `SEID` token can be exposed in web proxy logs and browser history. An attacker who captures the `SEID` and originates requests from the same IP address can access the device's user interface without knowing the credentials.

The issue concerns improper access control in the Barco wePresent WiPG-1600W device. The device includes an SSH daemon in its firmware image, which is disabled by default and does not start at system boot. However, a malicious actor can manipulate the device configuration by including a specific variable in a POST request, causing the SSH daemon to start when the device boots. This could potentially allow unauthorized access to the device.