CVE-2016-1560

ExaGrid appliances with firmware before 4.8 P26 have a default password of 1 inflection for the root shell account and 2 support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session...

CVE-2016-1561

ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorizedkeys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image. Recent assessments: h00die at March 24, 202...

ExaGrid - Known SSH Key and Default Password Exploit

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class MetasploitModule 'ExaGrid Known SSH Key and Default Password',...

ExaGrid Arbitrary Command Execution Vulnerability

ExaGrid is a Linux-based backup and recovery storage appliance from ExaGrid, Inc. that provides deduplication capabilities. A security vulnerability exists in ExaGrid, which can be exploited by an attacker to take full control of the device and execute arbitrary commands with root privileges...

ExaGrid Unauthorized Access Vulnerability

ExaGrid is a Linux-based backup and recovery storage appliance from ExaGrid, Inc. that provides deduplication capabilities. A security vulnerability exists in ExaGrid, which can be exploited by attackers to gain unauthorized access...

ExaGrid Known SSH Key / Default Password

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class MetasploitModule 'ExaGrid Known SSH Key and Default Password', 'Description' = %q ExaGrid ships a public/private key pair on...

ExaGrid Private SSH Key Removed

ExaGrid has removed a private SSH key and weak, hardcoded credentials shipping with all of its disk-based storage appliances. Updated firmware has been available since March 24 and storage and security managers are urged to update devices to version 4.8 P26. Researcher James Lee of Rapid7 private...

ExaGrid Default Credentials (HTTP)

The remote ExaGrid device has default credentials set. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exagrid Known Private Key Vulnerability (SSH) - Active Check

The Exagrid device is using a known SSH private key. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ExaGrid Known SSH Key and Default Password

ExaGrid ships a public/private key pair on their backup appliances to allow passwordless authentication to other ExaGrid appliances. Since the private key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. Additionally, this module will attempt to use the...

ExaGrid - Known SSH Key and Default Password (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class MetasploitModule 'ExaGrid Known SSH Key and Default Password', 'Description' = %q ExaGrid ships a public/private key pair on...

Backup Copy Job Failures when using ExaGrid de-duplicating storage

Challenge Backup Copy Jobs can fail when writing to ExaGrid storage. Cause De-duplicating storage can incorrectly update existing backup files during Veeam "merge" operation. Solution Make sure your ExaGrid Storage firmware version is 4.7.0 P52 or newer. For additional information please contact...