An insecure default configuration in the Beck IPC@CHIP allows an intruder to obtain priviledged system information.
The Beck IPC@CHIP is a single chip embedded webserver. The Beck IPC@CHIP ships with a cgi script named "ChipCfg". Using a specially crafted url, an attacker can cause this cgi script to return sensitive network configuration data stored on the IPC@CHIP.
An intruder can gain access to sensitive network data stored on the IPC@CHIP.
According to Ernest Schloesser of Beck IPC GmbH, the API allows removal of this CGI with the CGI_REMOVE function.
This vulnerability was discovered by Sentry Research Labs.
This document was written by Ian A. Finlay.
|Date First Published:||2001-09-14|
|Date Last Updated:||2003-04-09 18:52 UTC|