Vulnerability Note VU#574739
Beck GmbH IPC@Chip does not adequately validate user input thereby disclosing sensitive network data via crafted URL
An insecure default configuration in the Beck IPC@CHIP allows an intruder to obtain priviledged system information.
The Beck IPC@CHIP is a single chip embedded webserver. The Beck IPC@CHIP ships with a cgi script named "ChipCfg". Using a specially crafted url, an attacker can cause this cgi script to return sensitive network configuration data stored on the IPC@CHIP.
An intruder can gain access to sensitive network data stored on the IPC@CHIP.
According to Ernest Schloesser of Beck IPC GmbH, the API allows removal of this CGI with the CGI_REMOVE function.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Beck GmbH||Affected||21 May 2001||17 Jul 2002|
CVSS Metrics (Learn More)
This vulnerability was discovered by Sentry Research Labs.
This document was written by Ian A. Finlay.
- CVE IDs: CAN-2001-1341
- Date Public: 24 May 2001
- Date First Published: 14 Sep 2001
- Date Last Updated: 09 Apr 2003
- Severity Metric: 6.75
- Document Revision: 14
If you have feedback, comments, or additional information about this vulnerability, please send us email.