Overview
An insecure default configuration in the Beck IPC@CHIP allows an intruder to obtain priviledged system information.
Description
The Beck IPC@CHIP is a single chip embedded webserver. The Beck IPC@CHIP ships with a cgi script named "ChipCfg". Using a specially crafted url, an attacker can cause this cgi script to return sensitive network configuration data stored on the IPC@CHIP. |
Impact
An intruder can gain access to sensitive network data stored on the IPC@CHIP. |
Solution
According to Ernest Schloesser of Beck IPC GmbH, the API allows removal of this CGI with the CGI_REMOVE function. |
Vendor Information
574739
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was discovered by Sentry Research Labs.
This document was written by Ian A. Finlay.
Other Information
| CVE IDs: | CVE-2001-1341 |
| Severity Metric: | 6.75 |
| Date Public: | 2001-05-24 |
| Date First Published: | 2001-09-14 |
| Date Last Updated: | 2003-04-09 18:52 UTC |
| Document Revision: | 14 |