Psytester

Name of the Vulnerable Software and Affected Versions: eibPort V3 versions prior to 3.9.1 Description: The issue allows unauthenticated attackers to access the /webif/SecurityModule to validate the hard-coded unique 'eibPort String', which acts as the root SSH key passphrase. This can be part of an attack chain to gain SSH root access. Recommendations: For versions prior to 3.9.1, update to version 3.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /webif/SecurityModule endpoint until a patch is available. Avoid using the hard-coded `eibPort String` as the root SSH key passphrase in the affected versions.

Name of the Vulnerable Software and Affected Versions: BAB TECHNOLOGIE GmbH eibPort V3 versions prior to 3.9.1 Description: The issue allows unauthenticated attackers to access the /tmp path, which contains sensitive data such as the device serial number. This information can be used to self-calculate a possible loginId, enabling a brute force attack against the BMX interface. This can be part of an attack chain to gain SSH root access. Recommendations: For versions prior to 3.9.1, update to version 3.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp path and the BMX interface to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: eibPort V3 versions prior to 3.9.1 Description: The issue allows unauthenticated attackers to request any internal and external server due to a basic Server-Side Request Forgery (SSRF) vulnerability. Recommendations: For versions prior to 3.9.1, update to version 3.9.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: BAB TECHNOLOGIE GmbH eibPort V3 versions prior to 3.9.1 Description: The issue allows unauthenticated attackers to access the login service at "/webif/SecurityModule" in a brute force attack. The password could be weak and the default username is known as `admin`. This can be part of an attack chain to gain SSH root access. Recommendations: For versions prior to 3.9.1, update to version 3.9.1 or later to resolve the issue. As a temporary workaround, consider changing the default username and password, and restricting access to the "/webif/SecurityModule" endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: BAB TECHNOLOGIE GmbH eibPort V3 versions prior to 3.9.1 Description: The issue allows users to set weak passwords because, although the password strength is displayed in the configuration tool, it is not enforced. This can be part of an attack chain to gain SSH root access. Recommendations: For versions prior to 3.9.1, update to version 3.9.1 or later to enforce strong password requirements and prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: BAB TECHNOLOGIE GmbH eibPort V3 Description: The issue concerns a hard-coded and weak root SSH key passphrase, known as 'eibPort string', which is unique to each device. This passphrase can be used to gain SSH root access, representing the final part of an attack chain. Recommendations: For BAB TECHNOLOGIE GmbH eibPort V3, consider changing the hard-coded root SSH key passphrase to a strong and unique password to prevent unauthorized access. As a temporary workaround, restrict SSH access to minimize the risk of exploitation.

The issue allows for denial of service due to uncontrolled resource consumption. This can be triggered via requests to the lighttpd component.

The issue is related to a Denial of Service. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows Remote Code Execution in the JSON API Method `ReGa.runScript`, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory reset.

The issue allows remote code execution by unauthenticated attackers with access to the web interface. This is achieved via the exec.cgi script, which executes TCL script content from an HTTP POST request.

The issue allows remote code execution by unauthenticated attackers with access to the web interface. This is achieved via the `exec.cgi` and `exec1.cgi` scripts, which execute TCL script content from an HTTP POST request.

The issue allows remote code execution by unauthenticated attackers with access to the web interface. This is achieved via the "save.cgi" script for payload upload and the "testtcl.cgi" script for its execution.

The issue allows remote code execution by unauthenticated attackers with access to the web interface. This is achieved via an HTTP POST request to certain URLs related to the ReGa core process.

The issue allows an attacker to obtain session IDs without logging in, potentially leading to a Denial of Service and serving as a starting point for other attacks.

The issue allows for Denial of Service due to outdated base software packages.

The issue is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer, allowing uncontrolled admin access to start or stop the Node.js process. This results in the ability to obtain mediola configuration details.

The issue allows uncontrolled admin access, enabling attackers to obtain VPN profile details, shut down the VPN service, and delete the VPN service configuration. This is due to improper access control for all /addons/mh/ pages, specifically the API endpoints related to the "CloudMatic" add-on.

The issue is related to Improper Access Control in the JSON API for Interface.***Metadata related operations. This allows unauthorized access to read, set, and delete Metadata.

The issue allows administrative operations to be performed by unauthenticated attackers who have access to the web interface. This is because certain features, such as the File-Browser and Shell Command, as well as the ability to "Set root password", are exposed.

The issue allows for Remote Code Execution by unauthenticated attackers who have access to the web interface. This is possible because the web interface can access the CMD EXEC virtual device type 28.