Hardcoded credentials

2015-08-0401:59:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

21.3%

JSON

The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password.

CPENameOperatorVersion
magnum_10k_firmwarele4.5.5
magnum_6k_firmwarele4.5.5

CPE	Name	Operator	Version
	magnum_10k_firmware	le	4.5.5
	magnum_6k_firmware	le	4.5.5

References

www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf

www.securityfocus.com/bid/75235

ics-cert.us-cert.gov/advisories/ICSA-15-167-01