Cyberskr

The issue concerns a persistent XSS that can be exploited by acquiring the device's configuration file, inserting an XSS payload into a relevant field such as the `Satellite name`, and then restoring the malicious configuration file. This requires administrative access to exploit.

The issue allows an unauthenticated threat actor to exploit a persistent XSS via the "name" field in the /index.lua?pageID=Phone%20book endpoint.

The issue allows for an unauthenticated password reset, enabling modification of any user account's password, including the default "admin" account, without prior knowledge of the password. This can be achieved with knowledge of the username and by exploiting the attack vector through the "/index.lua" API endpoint, specifically the `usernameAdmChange`, `passwordAdmChange1`, and `passwordAdmChange2` fields.

The issue allows for arbitrary writing of content to the system's configuration file, which can be exploited through multiple attack vectors depending on the device's configuration. This can also lead to a Denial of Service (DoS) condition, requiring a factory reset to restore normal operation.

The issue allows unauthenticated users to change passwords for critical accounts, including Admin, Log, and Service, as well as the protected "SMS" panel. This is achieved through access to specific API endpoints: "/cgi-bin/sm changepassword.cgi" and "/cgi-bin/sm sms changepasswd.cgi".

The issue allows unauthenticated access to the xml/permission.xml file, which contains system usernames and passwords, including Admin and Service user accounts with unsalted MD5 hashes, and the SMS server password in cleartext.

The issue concerns the use of client-side JavaScript in the login.js file for authentication purposes.

A root privilege escalation issue in the web interface of Sonus SBC devices allows unauthorized access to privileged content.