CVE-2021-27172

An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh...

CVE-2021-27168

An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account...

CVE-2021-27168

CVE-2021-27168 affects FiberHome HG6245D devices via RP2613, where the rdsadmin account is exposed with a hardcoded password (6GFJdY4aAuUKJjdtSn7d). The issue enables potential unauthorized admin access over the network, with CVSS metrics indicating high confidentiality, integrity, and availabili...

CVE-2021-27172

The CVE-2021-27172 case concerns FiberHome HG6245D ONT routers (via RP2613). It relies on a hardcoded GEPON password for root stored in /etc/init.d/system-config.sh, enabling unauthorized root access. The NVD entry lists a CVSS3.1 base score of 9.8 (CRITICAL) with network attack vector and no aut...

PT-2021-17287

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D devices through RP2613 Description: An issue was discovered on FiberHome HG6245D devices, where there is a hardcoded password 6GFJdY4aAuUKJjdtSn7d for the rdsadmin account. Recommendations: For FiberHome HG6245D devices...

PT-2021-17291

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered where a hardcoded GEPON password for the root user is defined inside the /etc/init.d/system-config.sh file. Recommendations: For FiberHome HG6245D versions through...

CVE-2020-10539: Improper Authentication

An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user aka a...

Micro Focus UCMDB Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution', 'Description' = %q This module exploits two vulnerabilities, that...

Micro Focus UCMDB Remote Code Execution Exploit

This Metasploit module exploits two vulnerabilities, that when chained allow an attacker to achieve unauthenticated remote code execution in Micro Focus UCMDB. UCMDB included in versions 2020.05 and below of Operations Bridge Manager are affected, but this module can probably also be used to...

Backdoor.Win32.Wollf.c Hardcoded Backdoor Password

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/91c02a95839a76a5d2e335cded7112a9.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Wollf.c Vulnerability: Hardcoded Backdoor Password Description: The backdoor creates ...

Backdoor.Win32.Wollf.16 Hardcoded Password

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/5f79b779acd4c9c75211835a2783bccb.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Wollf.16 Vulnerability: Weak Hardcoded Password Description: Wollf.16 creates and run...

Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products

Zyxel has released a patch to address a critical vulnerability in its firmware concerning a hardcoded, undocumented secret account that could be abused by an attacker to login with administrative privileges and compromise its networking devices. The flaw, tracked as CVE-2020-29583 CVSS score 7.8,...

Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products

Zyxel has released a patch to address a critical vulnerability in its firmware concerning a hardcoded, undocumented secret account that could be abused by an attacker to login with administrative privileges and compromise its networking devices. The flaw, tracked as CVE-2020-29583 CVSS score 7.8,...

Hardcoded credentials

Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa which is just the asdf keyboard row in reverse order...

CVE-2020-28096: Undefined Security Weakness

FOSCAM FHD X1 1.14.2.4 devices allow attackers with physical UART access to login via the ipc.fos password...

CVE-2020-28093: Undefined Security Weakness

On Tenda AC1200 Model AC6 15.03.06.51multi devices, admin, support, user, and nobody have a password of 1234...

Hardcoded credentials

A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later...

CVE-2020-29583

CVE-2020-29583 (Zyxel hard-coded credentials) The Zyxel vulnerability concerns an undocumented user account, “zyfwp,” with an unchangeable password found in the firmware of multiple Zyxel devices. The account can grant admin access via SSH or the web interface. Affected devices include Zyxel USG/...

CVE-2020-29375

An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. An low-privileged non-admin attacker can use a hardcoded password 4ef9cea10b2362f15ba4558b1d5c081f to create an admin user...

CVE-2020-29375

An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. An low-privileged non-admin attacker can use a hardcoded password 4ef9cea10b2362f15ba4558b1d5c081f to create an admin user...