CVE-2021-31477

CVE-2021-31477 affects GE Reason RPV311 14A03. The vulnerability arises from hard-coded default credentials stored in the device firmware/filesystem, enabling remote attackers to execute arbitrary code with the download user context without authentication. Several sources (ZDI advisory ZDI-21-616...

CVE-2021-31477

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain...

Enphase Envoy Trust Management Vulnerability

The Enphase Energy Envoy is a gateway device for connecting smart home devices from Enphase Energy USA. The Enphase Energy Envoy has a trust management issue vulnerability that stems from the installer and Enphase accounts having hard-coded web panel login passwords, which are hard-coded values...

CVE-2021-31477: Use of Hard-coded Credentials

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain...

Logic flaw vulnerability in hera task scheduling system

hera task scheduler is a distributed task scheduler based on zeus rewrite. The hera Task Scheduler suffers from a logic flaw that can be exploited by an attacker to forge arbitrary login credentials via a built-in hard-coded key...

CVE-2020-25752: Use of Hard-coded Credentials

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. T...

PT-2021-19428

Name of the Vulnerable Software and Affected Versions Akkadian Provisioning Manager Engine PME versions prior to 5.0.2 Akkadian OVA appliance versions prior to 3.0 Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0 Description The issue concerns a hard-coded credential, with the...

PT-2021-19388

Name of the Vulnerable Software and Affected Versions Arlo Q Plus version 1.9.0.3 278 Description This issue allows attackers with physical access to escalate privileges on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the SSH servic...

Arlo Q Plus SSH Use of Hard-coded Credentials Privilege Escalation Vulnerability

This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSH service. The device can be booted into a special operation mode where...

Unspecified Vulnerability in ZOLL Defibrillator Dashboard

ZOLL Defibrillator Dashboard is an asset management tool from ZOLL USA. Provides at-a-glance readiness checks for the entire defibrillator fleet, even for defibrillators on multiple campuses and locations. A security vulnerability exists in all versions of ZOLL Defibrillator Dashboard prior to 2....

Bugs Lurking in Cisco UC Provisioning Platform

The Akkadian Provisioning Manager, which is used as a third-party provisioning tool within Cisco Unified Communications environments, has three high-severity security vulnerabilities that can be chained together to enable remote code execution RCE with elevated privileges, researchers said. They...

ZOLL Defibrillator Dashboard

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: ZOLL Equipment: Defibrillator Dashboard Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Use of Hard-coded Cryptographic Key, Cleartext Storage of Sensitive Information, Cross-site...

CVE-2020-15382

Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time...

CVE-2020-15382

Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time...

CVE-2020-15382

CVE-2020-15382 affects Brocade SANnav before version 2.1.1, where a hard-coded administrator account with the weak password 'passw0rd' is created if no PostgreSQL password is provided at install time. The remediation is to upgrade to SANnav 2.1.1 or apply the vendor patch per BSA-2021-1484.

CVE-2020-15382: Use of Hard-coded Credentials

Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time...

PT-2021-9762

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.1.1 Description The issue concerns the use of a hard-coded administrator account with a weak password passw0rd for PostgreSQL if no password is provided during installation. Recommendations For versions prior...

Hardcoding vulnerability in IEXplorer

The official version of iExplorer is an iTunes fast synchronization management tool for Apple users. IEXplorer has a hard-coded vulnerability that can be exploited by attackers to obtain sensitive information...

Bosch Multiple Product Access Control Vulnerabilities

Bosch B426 and others are a firmware from Bosch Germany. An access control error vulnerability exists in multiple Bosch products that stems from the use of hard-coded session tokens in the lgs.cgi module. The vulnerability allows remote attackers to bypass the authentication of the affected Bosch...

Bosch B426 Web Configuration Use of Hard-coded Password Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Bosch B426. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lgs.cgi module. This issue results from the use of hard-coded session token. An attacker c...