Secunia

Dinos has reported a security issue in Intracom JetSpeed ADSL Modem, which can be exploited by malicious people to disclose potentially sensitive information.

The problem is caused due to several pages from the web management interface of the modem being accessible without requiring authentication. This can be exploited to disclose username information from the "/cli/list_users.txt" file.

The security issue has been reported in Jetspeed 500 and 520 modems that use the Virata-EmWeb web server release 6_1_0.

NOTE: Older firmware versions reportedly has the default username and password of “intracom/123456″, which can't be changed.

Solution
Ensure that a strong password is set for all user accounts created in the modem.

Provided and/or discovered by
Dinos

Changelog
Further details available in Customer Area

Original Advisory
http://blog.globalnetworks.gr/?p=4

Deep Links
Links available in Customer Area