9734fcef1e
12 changes to exploits/shellcodes/ghdb Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS' Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure' FAQ Management System v1.0 - 'faq' SQL Injection Flashcard Quiz App v1.0 - 'card' SQL Injection Simple Inventory Management System v1.0 - 'email' SQL Injection comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset Online Shopping System Advanced - Sql Injection taskhub 2.8.7 - SQL Injection IBM i Access Client Solutions v1.1.2 - 1.1.4_ v1.1.4.3 - 1.1.9.4 - Remote Credential Theft
63 lines
No EOL
1.8 KiB
Text
63 lines
No EOL
1.8 KiB
Text
[+] Credits: John Page (aka hyp3rlinx)
|
|
[+] Website: hyp3rlinx.altervista.org
|
|
[+] Source: http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_ACCOUNT_ENUMERATION_CVE-2024-25734.txt
|
|
[+] twitter.com/hyp3rlinx
|
|
[+] ISR: ApparitionSec
|
|
|
|
|
|
[Vendor]
|
|
www.wyrestorm.com
|
|
|
|
|
|
[Product]
|
|
APOLLO VX20 < 1.3.58
|
|
|
|
[Vulnerability Type]
|
|
Account Enumeration
|
|
|
|
|
|
[CVE Reference]
|
|
CVE-2024-25734
|
|
|
|
|
|
[Security Issue]
|
|
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered.
|
|
Attackers who can reach the Apollo VX20 Telnet service can determine valid accounts, this can potentially allow for brute force attack on a valid account.
|
|
|
|
|
|
[Exploit/POC]
|
|
TELNET x.x.x.x 23
|
|
username:aa
|
|
username:bb
|
|
username:admin
|
|
password:
|
|
|
|
|
|
[Network Access]
|
|
Remote
|
|
|
|
|
|
[Affected Product Code Base]
|
|
APOLLO VX20 - < 1.3.58, fixed in v1.3.58
|
|
|
|
|
|
[Severity]
|
|
Medium
|
|
|
|
|
|
[Disclosure Timeline]
|
|
Vendor Notification: January 18, 2024
|
|
Vendor released fixed firmware v1.3.58: February 2, 2024
|
|
February 11, 2024 : Public Disclosure
|
|
|
|
|
|
|
|
[+] Disclaimer
|
|
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
|
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
|
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
|
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
|
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
|
or exploits by the author or elsewhere. All content (c).
|
|
|
|
hyp3rlinx |