Vulnerabilities > CVE-2010-2467 - Credentials Management vulnerability in multiple products

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

NVD

Published: 2010-06-25

Updated: 2017-08-17

Summary

The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTP server that stores database backups, which makes it easier for remote attackers to download backup files via unspecified FTP requests.

Vulnerable Configurations

Part	Description	Count
Hardware	S2Sys S2Sys Netbox 2.5 S2Sys Netbox 3.3 S2Sys Netbox 4.0	3
Hardware	Linearcorp Linearcorp Emerge 50 * Linearcorp Emerge 5000 *	2
Hardware	Sonitrol Sonitrol Eaccess *	1

Common Weakness Enumeration (CWE)

CWE-255 - Credentials Management

References

http://blip.tv/file/3414004
http://www.darkreading.com/blog/archives/2010/04/attacking_door.html
http://www.securityinfowatch.com/Executives+Columns+%2526+Features/1316527?pageNum=2
http://www.slideshare.net/shawn_merdinger/we-dont-need-no-stinkin-badges-hacking-electronic-door-access-controllersquot-shawn-merdinger-carolinacon
https://exchange.xforce.ibmcloud.com/vulnerabilities/59828