VAR-200508-0254

Vulnerability from variot - Updated: 2025-04-03 22:09

The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink RTA300W, allows remote attackers to access the Telnet port without authentication via certain packets to the web interface that cause the interface to freeze. The Siemens Santis 50 wireless router is a wi-fi (802.11b) ADSL router for home and small business networks.

Siemens Santis 50 provides a web management interface and a classic telnet CLI for management purposes. These services are only available through the local network by default, but can also be activated through the WAN interface. Siemens Santis 50 Wireless router Web interface is affected by a remote denial of service vulnerability. The attacker can also erase the FLASH contents. Information obtained may be used in further attacks against the vulnerable device or the network it operates on. This issue may also affect the Ericsson HN294dp and Dynalink RTA300W routers. Both devices are believed to use the same hardware as the Siemens Santis 50 Wireless router; this has not been confirmed by Symantec.

Bist Du interessiert an einem neuen Job in IT-Sicherheit?

Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/

TITLE: Siemens Santis 50 Authentication Bypass Vulnerability

SECUNIA ADVISORY ID: SA16215

VERIFY ADVISORY: http://secunia.com/advisories/16215/

CRITICAL: Moderately critical

IMPACT: Security Bypass

WHERE:

From local network

OPERATING SYSTEM: Siemens Santis 50 http://secunia.com/product/5440/

DESCRIPTION: Luca Carettoni has reported a vulnerability in Siemens Santis 50, which can be exploited by malicious people to bypass certain security restrictions. This can reportedly be exploited to view configuration information and potentially erase the device's flash memory.

The vulnerability has been reported in firmware version 4.2.8.0. Other versions may also be affected.

SOLUTION: Restrict access to the device.

PROVIDED AND/OR DISCOVERED BY: Luca Carettoni, Secure Network.

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website
To clipboard 

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "santis 50",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "siemens",
        "version": "4.2.8.0"
      },
      {
        "_id": null,
        "model": null,
        "scope": null,
        "trust": 0.6,
        "vendor": "none",
        "version": null
      },
      {
        "_id": null,
        "model": "santis wireless router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "siemens",
        "version": "504.2.8.0"
      },
      {
        "_id": null,
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "santis 50",
        "version": "4.2.8.0"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595"
      },
      {
        "db": "BID",
        "id": "14372"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2424"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Luca Carettoni  luca.carettoni@securenetwork.it",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2005-2424",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2005-2424",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "c62bae40-2355-11e6-abef-000c29c66e3d",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-13633",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2005-2424",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200508-018",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "c62bae40-2355-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-13633",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-13633"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2424"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink RTA300W, allows remote attackers to access the Telnet port without authentication via certain packets to the web interface that cause the interface to freeze. The Siemens Santis 50 wireless router is a wi-fi (802.11b) ADSL router for home and small business networks. \n\n\u00a0Siemens Santis 50 provides a web management interface and a classic telnet CLI for management purposes. These services are only available through the local network by default, but can also be activated through the WAN interface. Siemens Santis 50 Wireless router Web interface is affected by a remote denial of service vulnerability.  The attacker can also erase the FLASH contents. \nInformation obtained may be used in further attacks against the vulnerable device or the network it operates on. \nThis issue may also affect the Ericsson HN294dp and Dynalink RTA300W routers.  Both devices are believed to use the same hardware as the Siemens Santis 50 Wireless router; this has not been confirmed by Symantec. \n\n----------------------------------------------------------------------\n\nBist Du interessiert an einem neuen Job in IT-Sicherheit?\n\n\nSecunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-\nSicherheit:\nhttp://secunia.com/secunia_vacancies/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens Santis 50 Authentication Bypass Vulnerability\n\nSECUNIA ADVISORY ID:\nSA16215\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/16215/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nSecurity Bypass\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nSiemens Santis 50\nhttp://secunia.com/product/5440/\n\nDESCRIPTION:\nLuca Carettoni has reported a vulnerability in Siemens Santis 50,\nwhich can be exploited by malicious people to bypass certain security\nrestrictions. This can reportedly be exploited to\nview configuration information and potentially erase the device\u0027s\nflash memory. \n\nThe vulnerability has been reported in firmware version 4.2.8.0. \nOther versions may also be affected. \n\nSOLUTION:\nRestrict access to the device. \n\nPROVIDED AND/OR DISCOVERED BY:\nLuca Carettoni, Secure Network. \n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-2424"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595"
      },
      {
        "db": "BID",
        "id": "14372"
      },
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-13633"
      },
      {
        "db": "PACKETSTORM",
        "id": "38873"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2005-2424",
        "trust": 2.5
      },
      {
        "db": "BID",
        "id": "14372",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "16215",
        "trust": 1.8
      },
      {
        "db": "OSVDB",
        "id": "18294",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595",
        "trust": 0.8
      },
      {
        "db": "XF",
        "id": "50",
        "trust": 0.6
      },
      {
        "db": "XF",
        "id": "21552",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20050725 SIEMENS SANTIS 50 AUTHENTICATION VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "IVD",
        "id": "C62BAE40-2355-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-13633",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "38873",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595"
      },
      {
        "db": "VULHUB",
        "id": "VHN-13633"
      },
      {
        "db": "BID",
        "id": "14372"
      },
      {
        "db": "PACKETSTORM",
        "id": "38873"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2424"
      }
    ]
  },
  "id": "VAR-200508-0254",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595"
      },
      {
        "db": "VULHUB",
        "id": "VHN-13633"
      }
    ],
    "trust": 0.09
  },
  "iot_taxonomy": {
    "_id": null,
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595"
      }
    ]
  },
  "last_update_date": "2025-04-03T22:09:51.878000Z",
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-2424"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/14372"
      },
      {
        "trust": 1.7,
        "url": "http://www.securenetwork.it/advisories/"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/18294"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/16215"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21552"
      },
      {
        "trust": 1.0,
        "url": "http://marc.info/?l=bugtraq\u0026m=112230914431638\u0026w=2"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/21552"
      },
      {
        "trust": 0.6,
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=112230914431638\u0026w=2"
      },
      {
        "trust": 0.3,
        "url": "http://www.siemens.ch/index.jsp?sdc_p=d1093191po1092631f64c175l1s2mn1092631t4u1260\u0026"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/406379"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=bugtraq\u0026amp;m=112230914431638\u0026amp;w=2"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_vacancies/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/16215/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/5440/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-13633"
      },
      {
        "db": "BID",
        "id": "14372"
      },
      {
        "db": "PACKETSTORM",
        "id": "38873"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2424"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d",
        "ident": null
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595",
        "ident": null
      },
      {
        "db": "VULHUB",
        "id": "VHN-13633",
        "ident": null
      },
      {
        "db": "BID",
        "id": "14372",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "38873",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2424",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2005-07-26T00:00:00",
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d",
        "ident": null
      },
      {
        "date": "2005-07-26T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2005-2595",
        "ident": null
      },
      {
        "date": "2005-08-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-13633",
        "ident": null
      },
      {
        "date": "2005-07-25T00:00:00",
        "db": "BID",
        "id": "14372",
        "ident": null
      },
      {
        "date": "2005-07-27T16:08:40",
        "db": "PACKETSTORM",
        "id": "38873",
        "ident": null
      },
      {
        "date": "2005-07-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200508-018",
        "ident": null
      },
      {
        "date": "2005-08-03T04:00:00",
        "db": "NVD",
        "id": "CVE-2005-2424",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2005-07-26T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2005-2595",
        "ident": null
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-13633",
        "ident": null
      },
      {
        "date": "2005-07-25T00:00:00",
        "db": "BID",
        "id": "14372",
        "ident": null
      },
      {
        "date": "2005-10-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200508-018",
        "ident": null
      },
      {
        "date": "2025-04-03T01:03:51.193000",
        "db": "NVD",
        "id": "CVE-2005-2424",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "Siemens Santis 50 Wireless Router Web Interface Denial of Service Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2005-2595"
      },
      {
        "db": "BID",
        "id": "14372"
      }
    ],
    "trust": 1.1
  },
  "type": {
    "_id": null,
    "data": "Access verification error",
    "sources": [
      {
        "db": "IVD",
        "id": "c62bae40-2355-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200508-018"
      }
    ],
    "trust": 0.8
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.