Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:22473
HistorySep 16, 2009 - 12:00 a.m.

Improper Authentication Mechanism in 3Com Wireless8760 Dual Radio 11a/b/g Poe Access Point

2009-09-1600:00:00
vulners.com
10

Hi
My name is Yossi Yakubov and i am a security researcher. Recently me
and my collegues found the following vulnerability in the 3Com
Wireless8760 web administration interface:

If one user is authenticated to the web interface, other users can
access to internal pages without further authentication. That means
that one opened Session is enough between the user and web
administration , and other users can also access to the web
administration interface.

Malicious user can wait until ones logins to the interface and then he
can access and administer 3Com Wireless8760 Access Point without
further authentication. Among different operations the malicious user
can cause to Denial of Service (Dos) attack to the entire network by
changing the configuration such as IP addresses.

FYI

Waiting for your review

Best Regards

Yossi Yakubov