Test ID:	1.3.6.1.4.1.25623.1.0.103756
Category:	Web application abuses
Title:	Multiple Zoom Telephonics Devices Multiple Security Vulnerabilities (Aug 2013) - Active Check
Summary:	Multiple Zoom Telephonics devices are prone to an information; disclosure vulnerability, an authentication bypass vulnerability and an SQL injection (SQLi); vulnerability.
Description:	Summary: Multiple Zoom Telephonics devices are prone to an information disclosure vulnerability, an authentication bypass vulnerability and an SQL injection (SQLi) vulnerability. Vulnerability Insight: When UPnP services and WAN http administrative access are enabled, authorization and credential challenges can be bypassed by directly accessing root privileged abilities via a web browser URL. All aspects of the modem/router can be changed, altered and controlled by an attacker, including gaining access to and changing the PPPoe/PPP ISP credentials. Vulnerability Impact: Exploiting these issues could allow an attacker to gain unauthorized access and perform arbitrary actions, obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Affected Software/OS: - X4 ADSL Modem and Router - X5 ADSL Modem and 4-port Router Solution: Ask the Vendor for an update. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:P/A:P
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.