----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
ECI B-FOCuS Router firmwarecfg Missing Access Control Restrictions

SECUNIA ADVISORY ID:
SA16205

VERIFY ADVISORY:
http://secunia.com/advisories/16205/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass

WHERE:
>From local network

OPERATING SYSTEM:
B-FOCuS Router 312+
http://secunia.com/product/5436/

DESCRIPTION:
D.is.evil has reported a security issue in B-FOCuS Router 312+, which
can exploited by malicious people to bypass certain security
restrictions.

The problem is caused due to the lack of access controls on the
"/cgi-bin/firmwarecfg" page of the router's web management interface.
This can reportedly be exploited to retrieve sensitive information
such as the current router settings, connection and management
passwords, or to cause a DoS by resetting the router constantly.

SOLUTION:
Restrict access to the web management interface.

PROVIDED AND/OR DISCOVERED BY:
D.is.evil

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------