Test ID:	1.3.6.1.4.1.25623.1.0.803193
Category:	Default Accounts
Title:	Sitecom WLM-3500 Backdoor Accounts (HTTP)
Summary:	Sitecom WLM-3500 routers contain an undocumented access; backdoor.
Description:	Summary: Sitecom WLM-3500 routers contain an undocumented access backdoor. Vulnerability Insight: These hard-coded accounts are persistently stored inside the device firmware image. Despite these users cannot access all the pages of the web interface, they can still access page '/romfile.cfg', the (clear-text) configuration file of the device that contains, among the other things, also the password for the 'admin' user. Thus, escalating to administrative privileges is trivial. Vulnerability Impact: Successful exploitation will let the remote attacker to access the web interface of the affected devices using two distinct hard-coded users. Affected Software/OS: Sitecom WLM-3500 devices with firmware versions prior to 1.07. Solution: Update to firmware version 1.07 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Copyright	Copyright (C) 2013 Greenbone Networks GmbH

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.