Nuuo NT-4040 firmware contains insecure default credentials

Overview

Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentials

Description

CWE-255**: Credentials Management -**CVE-2016-6553

Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses non-random default credentials of: admin:admin and localdisplay:111111 . A remote network attacker can gain privileged access to a vulnerable device.

---

Impact

A remote attacker can take complete control of a device using default admin credentials.

---

Solution

Apply an update
Nuuo has released an update to address the issue. Please see the vendor information.

---

Restrict access and use strong passwords

As a general good security practice, only allow trusted hosts to connect to the device. Use of strong, unique passwords can help reduce the efficacy of brute force password guessing attacks.

---

Vendor Information

326395

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

NUUO __ Affected

Updated: December 13, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Nuuo has released an update which addresses the vulnerability. Please see the URL below to download the update. (web login required)

Vendor References

• <http://www.nuuo.com/DownloadDetail.php?id=0115&gt;

CVSS Metrics

Group	Score	Vector
Base	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C
Temporal	6.2	E:F/RL:W/RC:ND
Environmental	4.7	CDP:N/TD:M/CR:ND/IR:ND/AR:ND

References

• <http://cwe.mitre.org/data/definitions/255.html&gt;
• <https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/sshowdown-exploitation-of-iot-devices-for-launching-mass-scale-attack-campaigns.pdf&gt;

Acknowledgements

Thanks to Ory Segal and Ezra Caltum for reporting this vulnerability.

This document was written by Trent Novelly.

Other Information

CVE IDs:	CVE-2016-6553
Date Public:	2016-10-20 Date First Published: