The remote host is running a Grandstream GXV3370 device, firmware version prior to 1.0.1.41 , and is therefore affected by a RCE attack vector. An attacker can exploit a blind command injection vulnerability in the "file-backup" parameter of the 'backupUCMConfig' API call allowing the execution of arbitrary code.

CVSS Score based on analysis of the vendor advisory.

The remote host is running a Grandstream GXV3275 device, firmware version prior to 1.0.3.219, and is therefore affected by a remote command execution vulnerability that exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.

CVSS Score based on analysis of the vendor advisory.

The remote host is running a Grandstream GXV3240 device, firmware version prior to 1.0.3.219, and is therefore affected by a remote command execution vulnerability that exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.

CVSS Score based on analysis of the vendor advisory.

The remote host is running a Grandstream IP Multimedia Phone over the Session Initiation Protocol (SIP).

The remote host is running a Grandstream UCM6204 IP PBX, firmware version prior to 1.0.19.21, and is therefore affected by a RCE attack vector. An attacker can exploit a blind command injection vulnerability in the "file-backup" parameter of the 'backupUCMConfig' API call allowing the execution of arbitrary code.

CVSS Score based on analysis of the vendor advisory.

The remote host is running a Grandstream IP PBX Appliance over the Session Initiation Protocol (SIP).

The remote host is running a Grandstream audio/video device over the Session Initiation Protocol (SIP), which is a communication protocol for video and voice calls over the Internet.

The remote host is an S2 Network Node. S2 Network Node is an intelligent field panel that handles distributed processing for S2 NetBox access control and event monitoring systems. Access control and events from connected devices are aggregated to the S2 NetBox web interface and S2 Network Node supports up to seven modular S2 application blades for access control, inputs, outputs and temperature probes.

The remote host is an S2 Network Controller. S2 Network Controller is an intelligent field panel that handles distributed processing for S2 NetBox access control and event monitoring systems. Access control and events from connected devices are aggregated to the S2 NetBox web interface and S2 Network Controller supports up to seven modular S2 application blades for access control, inputs, outputs and temperature probes.

The remote host has been observed communicating via the HL7 protocol. HL7 provides a framework for the exchange, integration, sharing, and retrieval of electronic health information.

The remote host has been observed communicating via the DICOM protocol. The DICOM, or Digital Imaging and Communications in Medicine, is used to transfer medical images and related information. DICOM is utilized by many radiology, cardiology imaging, and radiotherapy devices.

The remote host is a Belkin WeMo device. WeMo is a series of products that enable users to control home electronics remotely. The suite includes electrical plugs, motion sensors, light switches, cameras, light bulbs, and a mobile app.

The remote host is a LaCie storage device used for networked file sharing.

The remote host is a Fujitsu ScanSnap scanner used for document imaging.

The remote host is a Crestron Touch Screen used for room and screen control. The touch screen may be installed on a wall, tabletop, or VESA mount. Displays of this type can integrate with conference rooms to provide control over projectors, screens, lighting, temperature, and more.

The remote host is a Cisco Telepresence device used for video conferencing and may include a camera, speakers, microphone, and appliance.

The remote host is a Chromecast device. Chromecast is a line of digital media players developed by Google. The devices, designed as small dongles, enable users with a mobile device or personal computer to initiate and control playback of Internet-streamed content.

The remote host is a Samsung smart TV used for streaming media.

The remote host is a Samsung device used for streaming media.

The remote host is a Sony device used for streaming media.

The remote host is a Roku device. Roku is a line of digital media players. The devices enable users to initiate and control playback of Internet-streamed content.

The remote host is vulnerable to a flaw which allows a remote attacker to control the system. The flaw, nicknamed Devil's Ivy stems from a buffer overflow in the gSoap component.

The remote host is communicating with Nest Labs through their mobile application. Nest Labs offers devices such as a learning thermostat, home monitoring webcam, and smoke detector, which are all Wi-Fi enabled. These devices can be remotely controlled and programmed through a smart phone app or through the Nest online portal.

The remote host is a Nest thermostat. Nest Labs offers devices such as a learning thermostat, home monitoring webcam, and smoke detector, which are all Wi-Fi enabled. These devices can be remotely controlled and programmed through a smart phone app or through the Nest online portal.

The remote device is a Xerox printer.  Further, it is configured with software which attempts to connect to xerox discovery services.

The remote device is running an HP printer with a web interface.

The Canon PIXMA is prone to information disclosure due to its unencrypted traffic when responding to a request from a web client. Furthermore, no authentication was detected to process this request (i.e., the admin password was not set). Any unauthenticated user on the same network would be able to sniff the network settings, including the wifi password if used.

The remote host appears to be a Samsung printer, or a Dell printer manufactured by Samsung.  It has a hardcoded SNMP read-write community string that allows access even when SNMP has been disabled in the printer management utility.  A remote, unauthenticated attacker could exploit this to take control of the printer.

A Lexmark print server is listening on this port.

The remote host is running the SAP Line Printer Daemon (LPD).

The remote host is a Xerox WorkCentre. 
This version of WorkCentre is vulnerable to a number of flaws.  Namely
  1) There are multiple command injection flaws that would allow an anonymous user to execute commands with the privileges of the WorkCentre Administrator.
  2) Administrative bypass within the TFTP/BOOTP auto configuration options.  This flaw would allow an attacker to make configuration changes that would impact the availability of the remote printer
  3) A flaw that would allow an attacker to hijack email messages and insert malicious code into the body of the message
  4) A flaw within the 'scan-to-mailbox' function that would allow an attacker to retrieve sensitive files
  5) A flaw that would allow an attacker to switch to the HTTP protocol instead of the HTTPS protocol

The remote host is a Xerox WorkCentre, a web-based printer and copier.

The remote host is running an HP printer.

The remote host is running Xerox Document Centre, an administrative, web-based GUI to a Xerox device.  This version is reportedly prone to a remote Denial of Service (DoS) attack.  An attacker exploiting this flaw would only need to be able to send malformed HTTP requests to the web interface of the printer.  A successful attack would result in a loss of availability to the users of the printer.

ID	Name	Severity
700498	Grandstream GXV3370 < 1.0.1.41 RCE	Critical
700497	Grandstream GXV3275 < 1.0.3.219 RCE	Critical
700496	Grandstream GXV3240 < 1.0.3.219 RCE	Critical
700495	Grandstream IP Multimedia Phone Version GXV3370 Firmware Detection (SIP)	Info
700494	Grandstream IP Multimedia Phone Version GXV3275 Firmware Detection (SIP)	Info
700493	Grandstream IP Multimedia Phone Version GXV3240 Firmware Detection (SIP)	Info
700492	Grandstream IP PBX Appliance UCM6204 < 1.0.19.21 RCE	Critical
700485	Grandstream IP PBX Appliance Version Detection (SIP)	Info
700484	Grandstream AV Device Detection (SIP)	Info
700478	S2 Network Node Multicast Detection	Info
700477	S2 Network Controller Detection	Info
700476	S2 Network Node Detection	Info
700406	HL7 Protocol Detection	Info
700405	HL7 Protocol Server Detection	Info
700404	HL7 Protocol Detection	Info
700403	HL7 Protocol Server Detection	Info
700402	DICOM Protocol Server Detection	Info
700401	DICOM Protocol Client Detection	Info
700400	DICOM Protocol Detection	Info
700210	Belkin WeMo Type Detection	Info
700209	Belkin WeMo Firmware Version Detection	Info
700208	Belkin WeMo Model Description Detection	Info
700206	LaCie Storage Device Software Version Detection	Info
700204	LaCie Storage Device Detection	Info
700203	Fujitsu ScanSnap Detection	Info
700202	Crestron Touch Screen Detection	Info
700201	Cisco Telepresence SNMP Detection	Info
700200	Cisco Telepresence FTP Server Detection	Info
700198	Cisco Telepresence SIP Detection	Info
700197	Cisco Telepresence RTSP Detection	Info
700164	Google Chromecast Detection (TCP)	Info
700163	Samsung Smart TV Detection	Info
700162	Samsung Device Detection	Info
700161	Sony Device Detection	Info
700160	Roku Device Detection	Info
700159	Google Chromecast Detection (UDP)	Info
7279	Axis Camera Multiple Products RCE (Devil's Ivy)	High
8838	Nest Labs Mobile Application Detection (deprecated)	Info
8837	Nest Labs Appliance Detection	Info
8235	Xerox Supernode Discovery Client Detection	Info
8228	HP Print Server Detection	Info
8179	Canon PIXMA MX722 Information Disclosure	Medium
6639	Samsung / Dell Printer SNMP Backdoor	Critical
5708	Ricoh Printer Detection	Info
5779	Lexmark Printer Service Detection	Info
4387	sapLPD Version Detection	Info
3834	Xerox WorkCentre Multiple Vulnerabilities	High
3832	Xerox WorkCentre Detection	Info
3786	HP Printer Detection	Info
2697	Xerox Document Centre Denial of Service (DoS)	High

IoT Family for Nessus Network Monitor