Overview
Multiple Avaya switches do not adequately protect privileged access.
Description
Avaya's P882, P880, P580, and P550R series switches do not adequately protect account access. As a result, a remote attacker can gain access to the switch via http or telnet. |
Impact
A remote attacker can gain privileged access to the switch. As a result, an attacker could read and/or write switch data. |
Solution
Upgrade the switch firmware. |
Workaround If you cannot upgrade the switch firmware as Avaya suggests, you may wish to disable the "manuf" & "diag" accounts on the switch. |
Vendor Information
482241
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://support.avaya.com/japple/css/japple?PAGE=avaya.css.OpenPage&temp.template.name=Avaya_P580_P882_Undocumented
- http://online.securityfocus.com/archive/1/295256/2002-10-15/2002-10-21/0
- http://online.securityfocus.com/archive/1/295567/2002-10-15/2002-10-21/0
- http://online.securityfocus.com/archive/1/295890/2002-10-15/2002-10-21/0
Acknowledgements
Thanks to Jacek Lipkowski for reporting this vulnerability.
This document was written by Ian A Finlay.
Other Information
| CVE IDs: | CVE-2002-1229 |
| Severity Metric: | 25.65 |
| Date Public: | 2002-10-11 |
| Date First Published: | 2002-10-18 |
| Date Last Updated: | 2002-10-18 14:48 UTC |
| Document Revision: | 5 |