CVE-2021-37555

TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled...

CVE-2021-37555

The CVE-2021-37555 entry describes TX9 Automatic Food Dispenser v3.2.57 with a root-access vulnerability via telnet on port 23 using the default root password 059AnkJ, enabling shell access and filesystem download through BusyBox tools (e.g., tar, nc). Related material (CVE-2019-16734) indicates ...

Insecure Default Initialization of Resource

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be ke...

D-LINK DIR-3040 服务组件使用默认密码（CVE-2021-21818）

The DIR-3040 is an AC3000-based wireless internet router. Zebra is an IP routing manager that provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols. The DIR-3040 runs this service by default on TCP port 2601 and can be accessed ...

Taiwan Secom Personnel Attendance Management Trust Management Issue Vulnerability

Taiwan Secom Personnel Attendance Management is an attendance management system from Taiwan Secom, China. Trust Management issue vulnerability, the vulnerability originates from the system using hard code admin default credentials, remote attackers can use the vulnerability to access the system...

LearningDigital Orca HCM digital learning platform 安全漏洞

LearningDigital Orca HCM digital learning platform is a digital learning platform from China-based LearningDigital. A security vulnerability exists in the Orca HCM digital learning platform, which stems from the platform's use of a weak factory default administrator password, which is hard-coded...

CVE-2021-35961 TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Use of Hard-coded Credentials

Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission...

D-LINK DIR-3040 Libcli test environment hard-coded password vulnerability

Summary A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability. Tested Versions D-LINK DIR-3040...

Huawei dg8045 - Authentication Bypass Vulnerability

Title: Huawei dg8045 - Authentication Bypass Author: Abdalrahman Gamal Vendor Homepage: www.huawei.com Version: dg8045 Hardware Version: VER.A POC: The default password of this router is the last 8 characters of the device's serial number which exist in the back of the device. An attacker can lea...

Atlassian Bugs Could Have Led to 1-Click Takeover

Atlassian, a platform used by 180,000 customers to engineer software and manage projects, could have been hijacked with a single click due to security flaws, researchers have disclosed. On Thursday, Check Point Research CPR published a report PDF outlining how an attacker could have exploited the...

Huawei DG8045 Authentication Bypass

Title: Huawei dg8045 - Authentication Bypass Date: 2020-06-24 Author: Abdalrahman Gamal Vendor Homepage: www.huawei.com Version: dg8045 Hardware Version: VER.A POC: The default password of this router is the last 8 characters of the device's serial number which exist in the back of the device. An...

Huawei dg8045 - Authentication Bypass

Title: Huawei dg8045 - Authentication Bypass Date: 2020-06-24 Author: Abdalrahman Gamal Vendor Homepage: www.huawei.com Version: dg8045 Hardware Version: VER.A POC: The default password of this router is the last 8 characters of the device's serial number which exist in the back of the device. An...

Unspecified vulnerability in Enphase Energy Envoy (CNVD-2021-45766)

The Enphase Energy Envoy is a gateway device for connecting smart home devices from Enphase Energy USA. A security vulnerability exists in the Enphase Energy Envoy. The vulnerability stems from the default admin password being set to the last 6 digits of the serial number. The serial number can b...

CVE-2021-34203

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 dir-2640-us, when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify...

CVE-2021-34203

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 dir-2640-us, when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify...

CVE-2021-34203

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 dir-2640-us, when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify...

CVE-2020-25753

The CVE-2020-25753 entry concerns Enphase Envoy R3.x and D4.x devices running v3 software. The issue arises from a default admin password set to the last 6 digits of the serial number, and the serial number is retrievable by an unauthenticated user at /info.xml. This combination creates a credent...

CVE-2020-25753

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml...

Enphase Envoy 安全漏洞

The Enphase Energy Envoy is a gateway device for connecting smart home devices from Enphase Energy USA. A security vulnerability exists in the Enphase Energy Envoy. The vulnerability stems from the default admin password being set to the last 6 digits of the serial number. The serial number can b...

FortiWLC - Hardcoded root password

A use of hard-coded password vulnerability in FortiWLC may allow a local, authenticated attacker to connect to the managed Access Point Meru AP and FortiAP-U as root using the default hard-coded username and password...