A vulnerability has been reported in 3Com OfficeConnect Wireless 11g Access Point, which can be exploited by malicious people to gain knowledge of sensitive information.

The vulnerability is caused due to an access control error allowing anyone to access certain hidden pages via the web interface.

Examples:
/main/config.bin
/main/profile.wlp?PN=ggg
/main/event.logs

Successful exploitation discloses sensitive device information including the administrator's username and password.

Solution
For 3Com OfficeConnect Wireless 11g Access Point (3CRWE454G72) update to firmware release 1.03.07A:
Further details available in Customer Area

Provided and/or discovered by
Originally discovered by:
Patrik, cqure.net.

Lostmon and vIOsOnE found that this also affects 3Com ADSL 11g Wireless Router (3CRADSL72).

Changelog
Further details available in Customer Area

Original Advisory
iDEFENSE:
http://www.idefense.com/application/poi/display?id=188&type=vulnerabilities

Deep Links
Links available in Customer Area