CVE-2017-12928: Use of Hard-coded Credentials

A hard-coded password of tecn0visi0n for the dlxuser account in TecnoVISION DLX Spot Player4 all known versions allows remote attackers to log in via SSH and escalate privileges to root access with the same credentials...

CVE-2017-8771: Use of Hard-coded Credentials

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root". The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the...

CVE-2017-8772: Use of Hard-coded Credentials

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet which is open by default with default credentials as root username:"root" password:"root" and can: 1. Read the entire file system; 2. Write to the file system; or 3. Execute any code that attacker desires malicious or not...

Moxa AWK-3131A Hard-coded Administrator Credentials Vulnerability(CVE-2016-8717)

Summary An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The device operating system contains an undocumented, privileged root account with hard-coded credentials, giving attackers full control of affected devices...

CVE-2017-14143: Use of Hard-coded Credentials

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzon...

CVE-2017-11351: Use of Hard-coded Credentials

Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account...

CVE-2017-14426: Use of Hard-coded Credentials

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices have 0644 /var/etc/shadow aka the /etc/shadow symlink target permissions...

CVE-2017-14422: Use of Hard-coded Credentials

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms...

CVE-2017-14428: Use of Hard-coded Credentials

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices have 0666 /var/run/hostapd permissions...

Hackers Can Remotely Access Syringe Infusion Pumps to Deliver Fatal Overdoses

Internet-of-things are turning every industry into the computer industry, making customers think that their lives would be much easier with smart devices. However, such devices could potentially be compromised by hackers. There are, of course, some really good reasons to connect certain devices t...

Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Hardcoded Vulnerability (CNVD-2017-25719)

The Medfusion 4000 Wireless Syringe Infusion Pump is a syringe infusion pump deployed in healthcare and public health for delivering small doses of medication in acute care settings. The Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump is vulnerable to a hard-coded vulnerability where...

Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Hardcoded Vulnerability

The Medfusion 4000 Wireless Syringe Infusion Pump is a syringe infusion pump deployed in healthcare and public health for delivering small doses of medication in acute care settings. The Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump is vulnerable to a hard-coded vulnerability where...

CVE-2017-14115: Use of Hard-coded Credentials

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and...

CVE-2017-14116: Use of Hard-coded Credentials

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 an...

PT-2017-3816

Name of the Vulnerable Software and Affected Versions Moxa PT-7528 versions 4.0 or lower Moxa PT-7828 versions 3.9 or lower Description The issue is related to the use of hard-coded credentials for the console configuration of Moxa Ethernet switches. Exploitation of this issue may allow an attack...

CVE-2014-8426: Use of Hard-coded Credentials

Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015...

Hardcoded credentials

A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device...

Hardcoded credentials

A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded private cryptographic keys that may allow an attacker to decrypt traffic from any other source...

CVE-2017-12709

CVE-2017-12709 describes a local-authentication vulnerability in Westermo MRD-305-DIN (older than 1.7.5.0) and MRD-315, MRD-355, MRD-455 (older than 1.7.5.0). The root cause is the use of hard-coded credentials, which could allow an unauthorized local user with low privileges to access the device...

CVE-2017-12709

A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device...