Two security issues in Abyss Webserver has been identified, which makes it easier for a malicious person to gain access to the web management interface while remaining undetected.

The webserver does not detect unsuccessful login attempts. This makes it easier to perform a brute force attack on the interface, since the attacker does not encounter delays nor has a limited number of attempts. Furthermore, Abyss Webserver does not log access to the web management interface, making it more difficult to identify a brute force attack.

Solution
This is reportedly fixed in version 2.x.

Provided and/or discovered by
Thomas Adams

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area