CVE-2013-5006

main_internet.php on the Western Digital My Net N600 and N750 with firmware 1.03.12 and 1.04.16, and the N900 and N900C with firmware 1.05.12, 1.06.18, and 1.06.28, allows remote attackers to discover the cleartext administrative password by reading the "var pass=" line within the HTML source code.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2013-07/0146.html
http://www.osvdb.org/95519
http://archives.neohapsis.com/archives/bugtraq/2013-07/0133.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/85903

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:westerndigital:my_net_n900:-:::::::*
	cpe:2.3:h:westerndigital:my_net_n900c:-:::::::*

Configuration 2 (hide)

cpe:2.3:h:westerndigital:my_net_n750:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-07-31 13:20

Updated : 2020-02-24 15:02

NVD link : CVE-2013-5006

Mitre link : CVE-2013-5006

JSON object : View

Products Affected

westerndigital

my_net_n900c
my_net_n750
my_net_n900

CWE

CWE-255

Credentials Management Errors

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2013-07/0146.html", "name": "20130722 Full Disclosure - WD My Net N600, N750, N900, N900C - Plain Text Disclosure of Admin Credentials", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.osvdb.org/95519", "name": "95519", "tags": [], "refsource": "OSVDB"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2013-07/0133.html", "name": "20130718 Western Digital My Net N600, N750, N900 and N900C - Plain text disclosure of administrative credentials", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85903", "name": "my-net-info-disc(85903)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "main_internet.php on the Western Digital My Net N600 and N750 with firmware 1.03.12 and 1.04.16, and the N900 and N900C with firmware 1.05.12, 1.06.18, and 1.06.28, allows remote attackers to discover the cleartext administrative password by reading the \"var pass=\" line within the HTML source code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-255"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-5006", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2013-07-31T13:20Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:westerndigital:my_net_n900:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:westerndigital:my_net_n900c:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:westerndigital:my_net_n750:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-02-24T15:02Z"}