RoomWizard Default Password and Sync Connector Credential Leak [CVE-2010-0214]

[Sean Lam <seansec () live com>]

*******************************************************************************
% Advisory Name: RoomWizard Default Password and Sync Connector Credential Leak
% Date: 2010-08-16
% Appliance/SW: RoomWizard Web-based room scheduling system
% Versions: Tested on Firmware 3.2.3 (Model RW10)
% Author: Sean Lam < seansec (at) live (d0t) com >
% Vendor Status: Vendor Contacted
% CVE Candidate: CVE-2010-0214
% Reference: n/a

*******************************************************************************


% Vulnerability Overview
************************

The RoomWizard Web based scheduling system with touch screen display uses a
default password: "roomwizard" which would allow remote attackers to obtain
console access at http://DeviceIP:80

Various configuration items can be tampered with once authenticated.


Additionally, a GET request on http://DeviceIP:80/admin/sign/DeviceSynch
will result in a leakage of the Sync Connector username and password on two
input boxes (password masked via type = password):

.....type="text" name="connectorusername" value="DOMAIN/DOMAINID"></td>

.....type="password" name="connectorpassword" value="DOMAINIDPASS"></td>



% Vendor Response & Timeline
****************************
2010-08-17    CERT/CC contacted for CVE Identifier Resvn (CVE-2010-0214)
        CERT/CC Vuln Tracking number VU#870601
2010-08-18    Vulnerability reported to CERT/CC and escalated to vendor
2010-12-21    CERT/CC informs vendor has fixed issue with latest patch



% Recommendations
************************
Apply latest patch released by vendor

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/