CVE-2014-8329

High

Published: 20/10/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Schrack Technik microControl devices with firmware before version 1.7.0 (937) store sensitive information under the web root with insufficient access control. This allows remote attackers to obtain access data for ftp and telnet services via a direct request for ZTPUsrDtls.txt.

Risk Assessment

Organizations may be exposed to unauthorized access to sensitive data, potentially leading to serious security incidents and loss of confidentiality.

Recommendation

It is recommended to update the device firmware to version 1.7.0 or later and implement appropriate access control measures for sensitive files.

Other vulnerabilities in Schrack Technik microControl

CVE-2014-5396High
The web interface in Schrack Technik microControl with firmware before version 1.7.0 (937) has a hardcoded password for the 'user' account. This makes it easier for remote attackers to gain access to the system.

Original NVD description (English source)

Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt.