Default credentials

Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...

Default credentials

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change...

WiseGiga NAS Multiple Vulnerabilities (Sep 2017) - Active Check

WiseGiga NAS devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:wisegiga:nas";...

FiberHome ADSL AN1020-25 - Improper Access Restrictions Vulnerability

Exploit for hardware platform in category web applications Title: ==== FiberHome Unauthenticated ADSL Router Factory Reset. Credit: ====== Name: Ibad Shah Twitter: @BeeFaauBee09 Website: beefaaubee09.github.io CVE: ===== CVE-2017-14147 Date: ==== 05-09-2017 dd/mm/yyyy About FiberHome: ======...

FiberHome Unauthenticated ADSL Router Factory Reset Vulnerability

FiberHome suffers from an unauthenticated ADSL router factory reset vulnerability. Title: ==== FiberHome Unauthenticated ADSL Router Factory Reset. Credit: ====== Name: Ibad Shah Twitter: @BeeFaauBee09 Website: beefaaubee09.github.io CVE: ===== CVE-2017-14147 Date: ==== 05-09-2017 dd/mm/yyyy Abou...

SeaWell Networks Spectrum SDC Trust Management Vulnerability

SeaWell Networks Spectrum SDC is a video solution. The solution utilizes ABR repackaging technology to simplify IP video delivery using a common format. A security vulnerability exists in SeaWell Networks Spectrum SDC version 02.05.00. The vulnerability stems from the program's use of default wea...

CVE-2017-14115

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and...

Default credentials

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893...

Telnet Credential Leak Reinforces Bleak State of IoT Security

Shortly after the Mirai attacks, Johannes Ullrich of the SANS Internet Storm Center ISC decided to try a little experiment. He put a security camera DVR online—a poorly secured one with default credentials—and observed how long it would take to become infected, and how often. He wasn’t...

Default credentials

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin"...

Default credentials

ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs...

TP-Link TD-W8901G Default Credentials / Authentcation Bypass

Exploit Title: MULTIPLE VULNERABILITIES ON TP-LINK Date: 10-08-2017 Exploit Author: v.Dhanunjaya Vendor Homepage: http://www.tp-link.in/ AFFECTED FRIMWARE : TD-W8901G Tested on: Windows 10,ubuntu 14.04 LTS Email : [email protected] Support : CRYPTONICRAPTURES TARGET :...

Default credentials

An authenticated standard user could reset the password of other users including the admin by altering form data. Affects kanboard before 1.0.46...

Default credentials

Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrapsocket function in Python with the default CERTNONE value for the certreqs argument...

Default credentials

libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log...

Default credentials

A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all...

Default credentials

DISPUTED An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline cracker...

Default credentials

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...

Linksys Smart Wi-Fi Router Default Credentials

Nessus has detected that the remote Linksys Smart Wi-Fi Router device has default credentials set for its web administration interface 'admin'/'admin'. An attacker can exploit this to gain administrative access to the affected device. C Tenable Network Security, Inc. include"compat.inc"; if...

Default credentials

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...