A weakness has been reported in NeoScale Systems CryptoStor 700 Series, which can be exploited by malicious people to bypass certain security restrictions.

The system uses a two-factor authentication mechanism based on username and password combination and smartcard tokens. The validation of the smartcard is performed by an ActiveX control in a user's browser and can be bypassed by disabling ActiveX scripting.

Successful exploitation allows bypassing the smartcard part of the two-factor authentication, but still requires knowledge of a valid username and password to access the administrator console.

Solution
Update to firmware version 2.6.

Provided and/or discovered by
Reported in a US-CERT Vulnerability Note.

Original Advisory
US-CERT VU#339004:
http://www.kb.cert.org/vuls/id/339004

Deep Links
Links available to Secunia VIM customers