Suggested description
The Cobham Satcom Sailor 800 and Sailor 900 devices contained a persistent Cross Site Scripting (XSS) vulnerability, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field (E.g. Satellite name), and then restoring the malicious configuration file.
Vulnerability Type
Cross Site Scripting (XSS)
Suggested description
The Cobham Satcom Sailor 800 and Sailor 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could be leveraged to achieve a Denial of Service (DoS) condition, where the device would require a factory reset to return to normal operation.
Vulnerability Type
Incorrect Access Control
Suggested description
The Cobham Satcom Sailor 250 and Sailor 500 devices contained an unauthenticated password reset vulnerability. This could allow them to modify any user account's password (including the default "admin" account), without prior knowledge of their password. All that is required is knowledge of the username and attack vector.
Vulnerability Type
Incorrect Access Control
Suggested description
The Furuno Felcom250 and Felcom500 devices allowed unauthenticated access to an XML file containing all of the system's usernames and passwords. This included the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext.
Vulnerability Type
Cleartext Password Disclosure