CVE-2015-7287

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, which allows remote attackers to execute commands by leveraging knowledge of this PIN and including it in an SMS message.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://cybergibbons.com/?p=2844Exploit
http://www.kb.cert.org/vuls/id/428280Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/BLUU-A3NQALThird Party Advisory, US Government Resource
http://cybergibbons.com/?p=2844Exploit
http://www.kb.cert.org/vuls/id/428280Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/BLUU-A3NQALThird Party Advisory, US Government Resource

Timeline

Published: Nov 25, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-72884.3CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 allow remote attackers to modify the configuration via a command in an SMS CVE-2015-72899.3Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have a hardcoded administrator password de CVE-2015-72904.3Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with fir CVE-2015-72916.8Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices w CVE-2015-72929.8Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attacker CVE-2015-72938.8Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.CVE-2015-72947.5ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.CVE-2015-72955.0hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allo CVE-2015-72964.3Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algo CVE-2015-72977.5SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a CVE-2015-72985.1ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the lis CVE-2015-72997.5SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attacke