Default credentials

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root" and can: 1. Read the entire file system; 2. Write to the file system; or 3. Execute any code that attacker desires malicious or not...

CVE-2017-8771

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root". The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the...

CVE-2017-8771

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root". The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the...

CVE-2017-8772

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root" and can: 1. Read the entire file system; 2. Write to the file system; or 3. Execute any code that attacker desires malicious or not...

Default credentials

Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...

Default credentials

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...

WiseGiga NAS Multiple Vulnerabilities (Sep 2017) - Active Check

WiseGiga NAS devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:wisegiga:nas";...

FiberHome ADSL AN1020-25 - Improper Access Restrictions Vulnerability

Exploit for hardware platform in category web applications Title: ==== FiberHome Unauthenticated ADSL Router Factory Reset. Credit: ====== Name: Ibad Shah Twitter: @BeeFaauBee09 Website: beefaaubee09.github.io CVE: ===== CVE-2017-14147 Date: ==== 05-09-2017 dd/mm/yyyy About FiberHome: ======...

SeaWell Networks Spectrum SDC Trust Management Vulnerability

SeaWell Networks Spectrum SDC is a video solution. The solution utilizes ABR repackaging technology to simplify IP video delivery using a common format. A security vulnerability exists in SeaWell Networks Spectrum SDC version 02.05.00. The vulnerability stems from the program's use of default wea...

FiberHome Unauthenticated ADSL Router Factory Reset Vulnerability

FiberHome suffers from an unauthenticated ADSL router factory reset vulnerability. Title: ==== FiberHome Unauthenticated ADSL Router Factory Reset. Credit: ====== Name: Ibad Shah Twitter: @BeeFaauBee09 Website: beefaaubee09.github.io CVE: ===== CVE-2017-14147 Date: ==== 05-09-2017 dd/mm/yyyy Abou...

CVE-2017-14115

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and...

Default credentials

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893...

Telnet Credential Leak Reinforces Bleak State of IoT Security

Shortly after the Mirai attacks, Johannes Ullrich of the SANS Internet Storm Center ISC decided to try a little experiment. He put a security camera DVR online—a poorly secured one with default credentials—and observed how long it would take to become infected, and how often. He wasn’t...

Default credentials

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs...

Default credentials

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...

TP-Link TD-W8901G Default Credentials / Authentcation Bypass

Exploit Title: MULTIPLE VULNERABILITIES ON TP-LINK Date: 10-08-2017 Exploit Author: v.Dhanunjaya Vendor Homepage: http://www.tp-link.in/ AFFECTED FRIMWARE : TD-W8901G Tested on: Windows 10,ubuntu 14.04 LTS Email : [email protected] Support : CRYPTONICRAPTURES TARGET :...

Default credentials

An authenticated standard user could reset the password of other users including the admin by altering form data. Affects kanboard before 1.0.46...

Default credentials

Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrapsocket function in Python with the default CERTNONE value for the certreqs argument...

Default credentials

libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log...

Default credentials

A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all...