published September 10, 2018
⚠️ An unauthenticated user can change admin account passwords on FURUNO FELCOM devices — it's as if anyone could stroll into an office and swap out the passwords on the filing cabinets! 🔒 Picture a bustling office where anyone can walk in and change the locks on the cabinets filled with sensitive files, all without showing ID. That's what this vulnerability allows on FURUNO FELCOM 250 and 500 devices — a recipe for chaos! An attacker could easily gain control over the Admin, Log, and Service accounts, leading to unauthorized access to critical system functions. They could even lock out legitimate users or manipulate the SMS panel, creating a huge security risk. This could compromise the safety and reliability of the communication systems on board. Absolutely devastating!
Picture a bustling office where anyone can walk in and change the locks on the cabinets filled with sensitive files, all without showing ID. That's what this vulnerability allows on FURUNO FELCOM 250 and 500 devices — a recipe for chaos! This vulnerability allows unauthenticated users to change passwords for multiple user accounts directly via specific CGI scripts, without any prior authentication checks. The affected scripts are /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi.
An attacker could easily gain control over the Admin, Log, and Service accounts, leading to unauthorized access to critical system functions. They could even lock out legitimate users or manipulate the SMS panel, creating a huge security risk. This could compromise the safety and reliability of the communication systems on board. Absolutely devastating! To mitigate this risk, ensure that access to the affected CGI scripts is restricted. Implement the necessary authentication checks to prevent unauthorized password changes. Regularly review and apply security updates as they become available. You've got this! With these steps, you'll bolster your defenses and keep your systems secure. 🛡️