Shawn Merdinger has reported a vulnerability in Senao SI-680H/SI-7800H, which potentially can be exploited by malicious people to cause a DoS and to gain access to certain system information.

The vulnerability is caused due to the phone allowing connections from the VxWorks debugger on port 17185/udp. This may be exploited to gain access to the phone's OS and to collect debugging information or to cause a DoS on the device.

The vulnerability has been reported in the following products:
* Senao SI-680H hardware version 1.7.0 with firmware version 0.03.0839
* Senao SI-7800H BSP version 2_2_1/33 with firmware version 0.03.0001

Solution
Restrict use to within trusted networks only.

Provided and/or discovered by
Shawn Merdinger

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038836.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041435.html

Deep Links
Links available in Customer Area