CVE-2013-3542 – Grandstream Backdoor / Cross Site Request Forgery / Cross Site Scripting

https://notcve.org/view.php?id=CVE-2013-3542

Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models with firmware 1.0.4.11, have a hardcoded account "!#/" with the same password, which makes it easier for remote attackers to obtain access via a TELNET session. Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, y posiblemente otros modelos de cámara con versión de firmware 1.0.4.11, poseen una cuenta embebida "!#/" con la misma contraseña, lo que facilita a atacantes remotos obtener acceso por medio de una sesión TELNET. Grandstream Series IP cameras suffer from backdoor, cross site request forgery, and cross site scripting vulnerabilities. • http://seclists.org/fulldisclosure/2013/Jun/84 https://www.youtube.com/watch?v=XkCBs4lenhI • CWE-798: Use of Hard-coded Credentials •