Secret Backdoors Found in German-made Auerswald VoIP System

guest · Dec 21, 2021

December 21, 2021

Multiple backdoors have been discovered during a penetration test in the firmware of a widely used voice over Internet Protocol (VoIP) appliance from Auerswald, a German telecommunications hardware manufacturer, that could be abused to gain full administrative access to the devices.

"Two backdoor passwords were found in the firmware of the COMpact 5500R PBX," researchers from RedTeam Pentesting said in a technical analysis published Monday. "One backdoor password is for the secret user 'Schandelah', the other can be used for the highest-privileged user 'admin.' No way was discovered to disable these backdoors."
Click to expand...

The vulnerability has been assigned the identifier CVE-2021-40859 and carries a critical severity rating of 9.8. Following responsible disclosure on September 10, Auerswald addressed the problem in a firmware update (version 8.2B) released in November 2021.

"Using the backdoor, attackers are granted access to the PBX with the highest privileges, enabling them to completely compromise the device," the researchers said. "The backdoor passwords are not documented. They secretly coexist with a documented password recovery function supported by the vendor."
Click to expand...

Log in or Sign up

Secret Backdoors Found in German-made Auerswald VoIP System

guest Guest

Log in or Sign up

Secret Backdoors Found in German-made Auerswald VoIP System

guest Guest

Useful Searches