Highwall Enterprise and Highwall Endpoint wireless IDS management interface contain multiple vulnerabilities which can lead to privilege escalation and code execution.
104af84b88d66190c16142880c76ba81765558cf0f8d6a9b89f3c81eacec3f1d
Multiple vulnerabilities in Highwall Enterprise and Highwall Endpoint
4.0.2.11045 management interface
SUMMARY
Highwall Enterprise and Highwall Endpoint wireless IDS management interface
contain multiple vulnerabilities which can lead to privilege escalation and
code execution.
DETAILS
Web interface of Highwall Enterprise and Highwall Endpoint don't properly
screens characters in user supplied input. This can lead to Multiple
Cross-Site Scripting and SQL Injection conditions. Vulnerabilities can be
exploited by malicious system operator to escalate privileges or run code on
his choice in context of Microsoft SQL Server back-end database. Also these
vulnerabilities possible can be exploited by external attacker by using
Access Point with special created SSID to bypass security restrictions or
escalate privileges.
DISCLOSURE TIMELINE
8 September 2006 - Initial vendor contact, no response received.
September 2006 - Initial vendor contact, no response received.
18 October 2006 - Public disclosure