TITLE:
Hitachi WirelessIP5000 IP Phone Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA17628

VERIFY ADVISORY:
http://secunia.com/advisories/17628/

CRITICAL:
Less critical

IMPACT:
Manipulation of data, Exposure of system information, Exposure of
sensitive information, DoS

WHERE:
>From local network

OPERATING SYSTEM:
Hitachi WirelessIP5000
http://secunia.com/product/6141/

DESCRIPTION:
Shawn Merdinger has reported some vulnerabilities in Hitachi
WirelessIP5000, which can be exploited by malicious people to gain
access to potentially sensitive information, to modify certain
information, and to cause a DoS (Denial of Service).

1) The SNMP service that runs on the IP phone allows read-write
access using any credentials. The service cannot be disabled and does
not allow the community strings to be changed. This can be exploited
to retrieve and modify the device configuration by sending SNMP
GetRequest or SetRequest to phone.

2) The phone has an undocumented open port 3390/tcp that allows
access to the Unidata Shell upon connection. The service reportedly
cannot be disabled and can potentially be exploited to gain access to
sensitive information and to cause a DoS.

3) The phone has a hardcoded administrative password of "0000". This
may be exploited by a user with physical access to the phone to
modify the phone's configuration.

4) The default index page of the phone's HTTP server (8080/tcp)
discloses information like phone software versions, phone MAC
address, IP address and routing information.

The vulnerabilities have been reported in firmware versions prior to
2.0.1.

SOLUTION:
Update to firmware version 2.0.1 or later and change the
administrative password manually.

PROVIDED AND/OR DISCOVERED BY:
Shawn Merdinger

ORIGINAL ADVISORY:
http://www.hitachi-cable.co.jp/ICSFiles/infosystem/security/76659792_e.pdf

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------