Hardcoded credentials

2016-06-2001:59:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.8%

JSON

The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers’ installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.

CPENameOperatorVersion
fonalityeq12.6
fonalityeq12.8
fonalityeq14.1.105
hud_weble1.4.1

Name	Operator	Version
fonality	eq	12.6
fonality	eq	12.8
fonality	eq	14.1.105
hud_web	le	1.4.1

References

www.kb.cert.org/vuls/id/754056