Multiple Zoom Telephonics Devices Vulnerabilities
Multiple Zoom Telephonics devices are prone to an information-disclosure vulnerability, multiple authentication bypass vulnerabilities and an SQL-injection vulnerability. Exploiting these issues could allow an attacker to gain unauthorized access and perform arbitrary actions, obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. All administrative items can be accessed through two URLs, and example commands that can be executed remotely through a web browser URL, or a modified HTTP GET/POST requests include changing passwords for admin accounts, clearing logs, remotely rebooting to default factory settings, and creating new admin or intermediate accounts.
