Sign-up

ID

VAR-200709-0379


CVE

CVE-2007-4747


TITLE

Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) Vulnerability to perform administrator operations in firmware etc.

Trust: 0.8

sources: JVNDB: JVNDB-2007-002601

DESCRIPTION

The telnet service in Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier does not require authentication, which allows remote attackers to perform administrative actions, aka CSCsj31729. Attackers can exploit these issues to gain administrative privileges on affected devices. ---------------------------------------------------------------------- BETA test the new Secunia Personal Software Inspector! The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors. Download the free PSI BETA from the Secunia website: https://psi.secunia.com/ ---------------------------------------------------------------------- TITLE: Cisco Video Surveillance IP Gateway and Services Platform Authentication Bypass SECUNIA ADVISORY ID: SA26721 VERIFY ADVISORY: http://secunia.com/advisories/26721/ CRITICAL: Moderately critical IMPACT: Security Bypass, System access WHERE: >From local network OPERATING SYSTEM: Cisco Video Surveillance IP Gateway Encoder/Decoder 1.x http://secunia.com/product/15611/ Cisco Video Surveillance Services Platform and Integrated Services Platform 1.x http://secunia.com/product/15612/ DESCRIPTION: Some vulnerabilities have been reported in Cisco Video IP Gateway and Services Platform, which can be exploited by malicious people to bypass certain security restrictions and compromise a vulnerable system. 2) The Cisco Video Surveillance Services Platform and Integrated Services Platform devices contain a default password for the "sypixx" and "root" accounts. This can be exploited to gain administrative shell access by connecting to the vulnerable service, but requires knowledge of the default password. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.cisco.com/en/US/products/products_security_advisory09186a00808b4d38.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2007-4747 // JVNDB: JVNDB-2007-002601 // BID: 25549 // VULHUB: VHN-28109 // PACKETSTORM: 59134

AFFECTED PRODUCTS

vendor:ciscomodel:video surveillance ip gateway encoder decoderscope:lteversion:1.8.1

Trust: 1.0

vendor:ciscomodel:video surveillance sp ispscope:lteversion:1.23.7

Trust: 1.0

vendor:ciscomodel:video surveillance sp isp decoder softwarescope:lteversion:1.11.0

Trust: 1.0

vendor:ciscomodel:video surveillance ip gateway encoder decoderscope:lteversion:firmware 1.8.1

Trust: 0.8

vendor:ciscomodel:video surveillance sp ispscope:lteversion:firmware 1.23.7

Trust: 0.8

vendor:ciscomodel:video surveillance sp isp decoder softwarescope:lteversion:firmware 1.11.0

Trust: 0.8

vendor:ciscomodel:video surveillance ip gateway encoder decoderscope:eqversion:1.8.1

Trust: 0.6

vendor:ciscomodel:video surveillance sp ispscope:eqversion:1.23.7

Trust: 0.6

vendor:ciscomodel:video surveillance sp isp decoder softwarescope:eqversion:1.11.0

Trust: 0.6

vendor:ciscomodel:video surveillance sp/isp decoder softwarescope:eqversion:1.11

Trust: 0.3

vendor:ciscomodel:video surveillance sp/ispscope:eqversion:1.23.7

Trust: 0.3

vendor:ciscomodel:video surveillance ip gateway encoder/decoderscope:eqversion:1.8.1

Trust: 0.3

vendor:ciscomodel:video surveillance sp/isp decoder softwarescope:neversion:1.16

Trust: 0.3

vendor:ciscomodel:video surveillance sp/ispscope:neversion:1.26

Trust: 0.3

vendor:ciscomodel:video surveillance ip gateway encoder/decoderscope:neversion:1.9.4

Trust: 0.3

sources: BID: 25549 // JVNDB: JVNDB-2007-002601 // CNNVD: CNNVD-200709-047 // NVD: CVE-2007-4747

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-4747
value: HIGH

Trust: 1.0

NVD: CVE-2007-4747
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200709-047
value: CRITICAL

Trust: 0.6

VULHUB: VHN-28109
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2007-4747
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-28109
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-28109 // JVNDB: JVNDB-2007-002601 // CNNVD: CNNVD-200709-047 // NVD: CVE-2007-4747

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-28109 // JVNDB: JVNDB-2007-002601 // NVD: CVE-2007-4747

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200709-047

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-200709-047

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-002601

PATCH
title:cisco-sa-20070905-videourl:http://www.cisco.com/en/US/products/csa/cisco-sa-20070905-video.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-002601

EXTERNAL IDS
db:NVDid:CVE-2007-4747
Trust: 2.8
db:BIDid:25549
Trust: 2.0
db:SECUNIAid:26721
Trust: 1.8
db:VUPENid:ADV-2007-3061
Trust: 1.7
db:OSVDBid:37503
Trust: 1.7
db:SECTRACKid:1018655
Trust: 1.7
db:JVNDBid:JVNDB-2007-002601
Trust: 0.8
db:CISCOid:20070905 CISCO VIDEO SURVEILLANCE IP GATEWAY AND SERVICES PLATFORM AUTHENTICATION VULNERABILITIES
Trust: 0.6
db:XFid:36449
Trust: 0.6
db:CNNVDid:CNNVD-200709-047
Trust: 0.6
db:VULHUBid:VHN-28109
Trust: 0.1
db:PACKETSTORMid:59134
Trust: 0.1
sources:
            
            
            VULHUB: VHN-28109 // 
            
            
            
            BID: 25549 // 
            
            
            
            JVNDB: JVNDB-2007-002601 // 
            
            
            
            PACKETSTORM: 59134 // 
            
            
            
            CNNVD: CNNVD-200709-047 // 
            
            
            
            NVD: CVE-2007-4747

REFERENCES
url:http://www.cisco.com/en/us/products/products_security_advisory09186a00808b4d38.shtml
Trust: 1.8
url:http://www.securityfocus.com/bid/25549
Trust: 1.7
url:http://osvdb.org/37503
Trust: 1.7
url:http://www.securitytracker.com/id?1018655
Trust: 1.7
url:http://secunia.com/advisories/26721
Trust: 1.7
url:http://www.vupen.com/english/advisories/2007/3061
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/36449
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4747
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-4747
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/36449
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2007/3061
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
url:/archive/1/478617
Trust: 0.3
url:http://www.cisco.com/warp/public/707/cisco-sa-20070905-video.shtml
Trust: 0.3
url:http://www.cisco.com/en/us/products/ps6936/index.html
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/26721/
Trust: 0.1
url:https://psi.secunia.com/
Trust: 0.1
url:http://secunia.com/product/15612/
Trust: 0.1
url:http://secunia.com/product/15611/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-28109 // 
            
            
            
            BID: 25549 // 
            
            
            
            JVNDB: JVNDB-2007-002601 // 
            
            
            
            PACKETSTORM: 59134 // 
            
            
            
            CNNVD: CNNVD-200709-047 // 
            
            
            
            NVD: CVE-2007-4747

CREDITS
Cisco Security bulletin
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200709-047

SOURCES
db:VULHUBid:VHN-28109
db:BIDid:25549
db:JVNDBid:JVNDB-2007-002601
db:PACKETSTORMid:59134
db:CNNVDid:CNNVD-200709-047
db:NVDid:CVE-2007-4747

LAST UPDATE DATE
2025-04-10T22:57:29.774000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-28109date:2017-07-29T00:00:00
db:BIDid:25549date:2016-07-05T22:00:00
db:JVNDBid:JVNDB-2007-002601date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200709-047date:2007-09-10T00:00:00
db:NVDid:CVE-2007-4747date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-28109date:2007-09-06T00:00:00
db:BIDid:25549date:2007-09-05T00:00:00
db:JVNDBid:JVNDB-2007-002601date:2012-06-26T00:00:00
db:PACKETSTORMid:59134date:2007-09-07T06:01:27
db:CNNVDid:CNNVD-200709-047date:2007-09-06T00:00:00
db:NVDid:CVE-2007-4747date:2007-09-06T22:17:00