PT-2024-35980

Name of the Vulnerable Software and Affected Versions: Victure RX1800 WiFi 6 Router version EN V1.0.0 r12 110933 Description: A problem was discovered in Victure RX1800 WiFi 6 Router devices. The TELNET service is enabled by default and exposed over the LAN. The root account is accessible without...

CVE-2024-46328

VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root...

CVE-2024-46328: Use of Hard-coded Password

VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root...

CVE-2024-46959

runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 URI via the rtsp:// protocol to receive the video and audio stream...

CVE-2024-46959: Use of Hard-coded Password

runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 URI via the rtsp:// protocol to receive the video and audio stream...

Apple Remote Desktop Root

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apple Remote Desktop Root Vulnerability', 'Description' = 'Enable and set root account to a chosen password on unpatched macOS High Sierra hosts...

Detecting AWS Account Compromise: Key Indicators in CloudTrail Logs for Stolen API Keys

As cloud infrastructure becomes the backbone of modern enterprises, ensuring the security of these environments is paramount. With AWS Amazon Web Services still being the dominant cloud it is important for any security professional to know where to look for signs of compromise. AWS CloudTrail...

CVE-2023-41920

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in...

CVE-2023-41920 Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in...

CVE-2023-41920

CVE-2023-41920 affects Kiloview P1/P2 4G Video Encoders. The vulnerability allows access to the root account without authentication when the device is configured with the IP 10.10.10.10 (automatic root login). Multiple connected sources describe an authentication bypass with hard-coded credential...

CVE-2023-41920 Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in...

Kiloview P1 and P2 Security Vulnerabilities

Kiloview P1 4G Video Encoder and Kiloview P2 4G Video Encoder are both a professional video encoder device from Kiloview China. A security vulnerability exists in the Kiloview P1 and P2. The vulnerability can be exploited by an attacker to access the root account without authentication...

CVE-2023-41920: Authentication Bypass by Primary Weakness

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in...

CVE-2024-36080: Improper Access Control

Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. NOTE: this is a serial-to-Ethernet converter that should not be placed at the edge of the network...

PT-2024-4478 · Westermo · Westermo Edw-100

Name of the Vulnerable Software and Affected Versions: Westermo EDW-100 devices through 2024-05-03 Description: The issue is related to a hidden root user account with a hardcoded password that cannot be changed in Westermo EDW-100 devices. This could allow a remote attacker to disclose informati...

CVE-2023-29155: Improper Authentication

Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system...

PT-2023-6767

Name of the Vulnerable Software and Affected Versions INEA ME RTU firmware versions 3.36b and prior Description The issue is related to inadequate authentication procedures in the INEA ME RTU firmware, which could allow an attacker to gain unauthorized access to the device. Specifically, versions...

Update now! Apple patches a raft of vulnerabilities

Apple has released security updates for its phones, iPads, Macs, watches and TVs. Updates are available for these products: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th...

Cisco Can’t Stop Using Hard-Coded Passwords

Theres a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an...

Cisco Emergency Responder Trust Management Issues Vulnerability

Cisco Emergency Responder is an emergency response framework from Cisco USA. A trust management issue vulnerability exists in Cisco Emergency Responder version 12.51SU4, which arises from the presence of static user credentials for the root account, which are typically used during development, an...