Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

NetScout Visualizer and InfiniStream allow admin takeover via web page

CVE-2008-6701 · published 17 years ago
Summary

The Visualizer V2100 and InfiniStream i1730 devices let anyone who knows a specific web address add a domain without checking permissions. This can let a remote user become an administrator and control the system. Apply the vendor's security update or block access to the add_domain.jsp page until a patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
netscout ngenius_infinistream i1730
cpe:2.3:h:netscout:ngenius_infinistream:i1730:*:*:*:*:*:*:*
netscout visualizer v2100
cpe:2.3:h:netscout:visualizer:v2100:*:*:*:*:*:*:*
Original advisory text
NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allows remote attackers to gain administrat...
NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allows remote attackers to gain administrator privileges via a direct request.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published10 Apr 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-6701 · NVD
Track software like this
Free during beta