Description
cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/archive/1/535938/100/0/threaded ↗
- http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html ↗
- http://seclists.org/fulldisclosure/2015/Jul/29 ↗
- http://www.securityfocus.com/bid/75559 ↗
- https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection ↗