CVE-2020-12878

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory...

CVE-2020-9306

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

CVE-2020-12878

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory...

CVE-2020-9306

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

Hardcoded credentials

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

Directory traversal

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory...

CVE-2020-9306

CVE-2020-9306 affects Digi ConnectPort X2e devices (SolarCity/Tesla branding) with hardcoded credentials stored in a .pyc-compiled file used at boot. FireEye analysis shows password_manager.pyc in /WEB/python/ contains five plaintext credentials for the python system user, enabling web and SSH ac...

CVE-2020-9306

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

CVE-2020-12878

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory...

CVE-2020-12878

CVE-2020-12878 affects Digi ConnectPort X2e devices (pre-3.2.30.6). The issue enables local privilege escalation from the python user to root via a symlink attack involving /WEB/python/.ssh and /etc/init.d/S50dropbear.sh. Exploitation, as described, follows: (1) authenticate as the python user, (...

CVE-2020-9306: Insufficiently Protected Credentials

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account...

CVE-2020-12878: Improper Link Resolution Before File Access

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory...

Digi ConnectPort Backlink Vulnerability

Digi ConnectPort is a server from Digi ConnectPort Digi USA, Inc. It provides wireless communication. A security vulnerability exists in Digi ConnectPort X2e before 3.2.30.6, which allows an attacker to exploit the vulnerability to escalate the privileges of a python user to root via a symbolic...

PT-2021-9475

Name of the Vulnerable Software and Affected Versions Digi ConnectPort X2e versions prior to 3.2.30.6 Description The issue allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh...

PT-2021-12846

Name of the Vulnerable Software and Affected Versions: Tesla SolarCity Solar Monitoring Gateway versions through 5.46.43 Description: The issue is related to the use of hard-coded credentials. Specifically, Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user...

CVE-2020-6973

Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 82002228K 08/09/2018, bios Version 1.2. Multiple cross-site scripting vulnerabilities exist that could allow an attacker to cause a denial-of-service condition...