CVE-2015-3971
HighSummary
The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, allowing remote attackers to read or write files and execute arbitrary JASIC code via a session on TCP port 1239.
Risk Assessment
The lack of authentication in the debug interface poses a serious security risk, enabling attackers to remotely manipulate data and perform unauthorized operations.
Recommendation
It is recommended to secure the debug interface by implementing authentication mechanisms and restricting access to TCP port 1239.
Other vulnerabilities in Janitza UMG 508, 509, 511, 604, 605
See all- CVE-2015-3972High
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, making it easier for remote attackers to gain access via a brute-force attack.
- CVE-2015-3968High
The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to read or write to files via a session on TCP port 21.
Original NVD description (English source)
The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute arbitrary JASIC code, via a session on TCP port 1239.