Home page logo

fulldisclosure logo Full Disclosure mailing list archives

RoomWizard Default Password and Sync Connector Credential Leak [CVE-2010-0214]
From: Sean Lam <seansec () live com>
Date: Thu, 6 Jan 2011 04:12:26 +0000

% Advisory Name: RoomWizard Default Password and Sync Connector Credential Leak
% Date: 2010-08-16
% Appliance/SW: RoomWizard Web-based room scheduling system
% Versions: Tested on Firmware 3.2.3 (Model RW10)
% Author: Sean Lam < seansec (at) live (d0t) com >
% Vendor Status: Vendor Contacted
% CVE Candidate: CVE-2010-0214
% Reference: n/a


% Vulnerability Overview

The RoomWizard Web based scheduling system with touch screen display uses a
default password: "roomwizard" which would allow remote attackers to obtain
console access at http://DeviceIP:80

Various configuration items can be tampered with once authenticated.

Additionally, a GET request on http://DeviceIP:80/admin/sign/DeviceSynch
will result in a leakage of the Sync Connector username and password on two
input boxes (password masked via type = password):

.....type="text" name="connectorusername" value="DOMAIN/DOMAINID"></td>

.....type="password" name="connectorpassword" value="DOMAINIDPASS"></td>

% Vendor Response & Timeline
2010-08-17    CERT/CC contacted for CVE Identifier Resvn (CVE-2010-0214)
        CERT/CC Vuln Tracking number VU#870601
2010-08-18    Vulnerability reported to CERT/CC and escalated to vendor
2010-12-21    CERT/CC informs vendor has fixed issue with latest patch

% Recommendations
Apply latest patch released by vendor

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • RoomWizard Default Password and Sync Connector Credential Leak [CVE-2010-0214] Sean Lam (Jan 06)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]