search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Beck GmbH IPC@Chip FtpD allows an attacker to gain access to the device

Vulnerability Note VU#426459

Original Release Date: 2001-09-26 | Last Revised: 2001-09-26


There is a vulnerability in the Beck IPC@CHIP that allows an attacker to gain access to the device.


The Beck IPC@CHIP is a single chip embedded webserver. This device also contains an ftp server that is configured by default to allow anonymous access. Additionally, the device grants full administrative access to any user who logs in as an anonymous user. Because there is no password set by default for anonymous login, a malicious user can connect to the service and do anything the legitimate system administrator could do logged in via ftp.


Unless the administrator changes the default settings on the Beck IPC@CHIP, an attacker can connect to the ftp service, log in as an anonymous user, gain superuser privileges, and do anything the administrator could do if they were logged in via ftp.


The CERT/CC is currently unaware of a practical solution to this problem.

Change the default settings on the ftp server to now allow anonymous access.

Vendor Information


Beck GmbH Affected

Notified:  May 21, 2001 Updated: September 26, 2001



Vendor Statement

Please see

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This vulnerability was discovered by Sentry Research Labs.

This document was written by Ian A. Finlay.

Other Information

CVE IDs: None
Severity Metric: 18.75
Date Public: 2001-05-24
Date First Published: 2001-09-26
Date Last Updated: 2001-09-26 17:52 UTC
Document Revision: 18

Sponsored by CISA.