CVE-2014-8389
CriticalSummary
The AirLive BU-2015, BU-3026, MD-3025, WL-2000CAM, and POE-200CAM v2 devices have a vulnerability related to the use of hard-coded credentials in the embedded Boa web server. Attackers can gain access to user data through specially crafted HTTP requests.
Risk Assessment
This vulnerability poses a risk of unauthorized access to user accounts, potentially leading to data theft or device takeover. Organizations should be aware of the potential threats associated with the use of these devices.
Recommendation
It is recommended to update the device firmware to the latest version that addresses this vulnerability and to change default credentials to stronger ones. Additionally, consider restricting access to the management interface to trusted IP addresses.
Original NVD description (English source)
cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests.