Secunia

Luca "ikki" Carettoni has reported a security issue and some vulnerabilities in Philips VOIP841, which can be exploited by malicious people to disclose sensitive information, conduct cross-site scripting attacks, and to bypass certain security restrictions.

1) A security issue is caused due to an undocumented account ("service":"service") which can be used to access the web administration interface with administrative privileges.

2) Input passed via the URL is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed in HTML requests is not properly sanitised before being used. This can be exploited to display arbitrary files on the device via directory traversal attacks.

Successful exploitation requires a valid user account, but can be used in combination with #1.

NOTE: It has also been reported that sensitive information, e.g. Skype credentials, are stored on the device in cleartext, which e.g. can be disclosed by combining the reported vulnerabilities.

The vulnerabilities are reported in Philips VOIP841 firmware version 1.0.4.50 and 1.0.4.80. Other versions may also be affected.

Solution
Use only in a trusted network environment. Do not follow untrusted links.

Provided and/or discovered by
Luca "ikki" Carettoni

Changelog
Further details available in Customer Area

Original Advisory
http://www.securenetwork.it/ricerca/advisory/download/SN-2008-01.txt

Deep Links
Links available in Customer Area